Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: high
Invalid

Token ID Starts at Zero Causing Compatibility Issues

pxlvre

Medium: Token ID Starts at Zero Causing Compatibility Issues

Description

  • The CurrenTokenID state variable initializes to 0 by default, causing the first minted NFT to have token ID 0.

  • Many protocols and marketplaces treat token ID 0 as invalid or use it as a null value, potentially causing integration issues.

uint256 public CurrenTokenID; // @> Starts at 0, not initialized
​
function mint(address to) public onlyOwner returns (uint256) {
uint256 _tokenId = CurrenTokenID; // @> First mint uses ID 0
_safeMint(to, _tokenId);
emit BidBeastsMinted(to, _tokenId);
CurrenTokenID++;
return _tokenId;
}

Risk

Likelihood:

  • Occurs immediately with the first minted token

  • Affects all early adopters and initial mints

Impact:

  • Token ID 0 may not display correctly on marketplaces

  • Integration failures with protocols that use 0 as null/empty value

  • Potential issues with off-chain indexing systems

  • May cause confusion in ownership verification systems

Proof of Concept

This test shows how the first minted token receives ID 0, which can cause compatibility issues with external systems.

function test_TokenIdStartsAtZero() public {
// 1. Initial state check
assertEq(bidBeasts.CurrenTokenID(), 0);
// 2. Mint first NFT
address firstMinter = address(0x1);
vm.prank(owner);
uint256 firstTokenId = bidBeasts.mint(firstMinter);
// 3. First token has ID 0
assertEq(firstTokenId, 0);
assertEq(bidBeasts.ownerOf(0), firstMinter);
// 4. This can cause issues in marketplace contracts
// Many contracts check: if (tokenId == 0) revert("Invalid token");
// 5. Example of potential issue in marketplace
BidBeastsNFTMarket market = new BidBeastsNFTMarket(address(bidBeasts));
vm.startPrank(firstMinter);
bidBeasts.approve(address(market), 0);
// Some marketplaces might reject token ID 0
// market.listNFT(0, 1 ether, 2 ether); // May fail in some implementations
vm.stopPrank();
}

Recommended Mitigation

Initialize the token ID counter to start at 1 instead of 0. This ensures compatibility with the broader ecosystem.

- uint256 public CurrenTokenID;
+ uint256 public CurrenTokenID = 1; // Start at 1 for better compatibility
​
function mint(address to) public onlyOwner returns (uint256) {
uint256 _tokenId = CurrenTokenID;
_safeMint(to, _tokenId);
emit BidBeastsMinted(to, _tokenId);
CurrenTokenID++;
return _tokenId;
}
Updates

Lead Judging Commences

cryptoghost Lead Judge 21 days ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.