Submission Details
Severity:
`FestivalPass::uri` does not check for `tokenId == 0`
No check in FestivalPass::uri for tokenId == 0
Description
It does not effect the protocol that much but it is a good practice to add zero checks. In FestivalPass::uri if we give 0 as tokenId's value then it will give wrong uri, which is not a good coding practice.
function uri(uint256 tokenId) public view override returns (string memory) {
// Handle regular passes (IDs 1-3)
@> if (tokenId <= BACKSTAGE_PASS) {
return string(abi.encodePacked("ipfs://beatdrop/", Strings.toString(tokenId)));
}
// Decode collection and item IDs
(uint256 collectionId, uint256 itemId) = decodeTokenId(tokenId);
// Check if it's a valid memorabilia token
if (collections[collectionId].priceInBeat > 0) {
// Return specific URI for this item
// e.g., "ipfs://QmXXX/metadata/5" for item #5
return string(abi.encodePacked(
collections[collectionId].baseUri,
"/metadata/",
Strings.toString(itemId)
));
}
return super.uri(tokenId);
}
Risk: No risk at all but it is a good practice to add zero checks
Proof of Concept
function test_Uri_Pass() public view {
// Regular passes should use default URI
assertEq(festivalPass.uri(0), "ipfs://beatdrop/0");//this is the main test
//assertEq(festivalPass.uri(2), "ipfs://beatdrop/2");
// assertEq(festivalPass.uri(3), "ipfs://beatdrop/3");
}
Recommended Mitigation
function uri(uint256 tokenId) public view override returns (string memory) {
// Handle regular passes (IDs 1-3)
+ require(tokenId >0, "tokenId cannot be zero");
@> if (tokenId <= BACKSTAGE_PASS) {
return string(abi.encodePacked("ipfs://beatdrop/", Strings.toString(tokenId)));
}
// Decode collection and item IDs
(uint256 collectionId, uint256 itemId) = decodeTokenId(tokenId);
// Check if it's a valid memorabilia token
if (collections[collectionId].priceInBeat > 0) {
// Return specific URI for this item
// e.g., "ipfs://QmXXX/metadata/5" for item #5
return string(abi.encodePacked(
collections[collectionId].baseUri,
"/metadata/",
Strings.toString(itemId)
));
}
return super.uri(tokenId);
}
Updates
Lead Judging Commences
inallhonesty about 1 month ago
Submission Judgement Published Assigned finding tags:
uri for non-existing ids
Rewards breakdown
nSLOC
234This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.