Santa's List
AI First Flight #3
Beginner FriendlyFoundry
EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

`tokenURI` Returns Metadata for Nonexistent NFTs

joshuapaul1

Root + Impact

Description

The NFT collection should return token metadata only for NFTs that have been minted. Queries for nonexistent token IDs should revert, consistent with ERC721 metadata expectations.

However, tokenURI ignores its tokenId argument and always returns TOKEN_URI. Any caller can request metadata for arbitrary, unminted token IDs.

function tokenURI(uint256 /* tokenId */ ) public pure override returns (string memory) {
// @> No existence check for tokenId.
// @> Returns metadata for every ID, including unminted IDs.
return TOKEN_URI;
}

Risk

Likelihood:

  • Marketplaces, indexers, and users commonly query tokenURI for token IDs when displaying NFT metadata.

  • Any caller can query arbitrary token IDs, including IDs beyond the collection’s minted supply.

Impact:

  • Metadata is returned for NFTs that do not exist.

  • Marketplaces and indexers can display misleading NFT information or treat unminted token IDs as valid collection items.

Proof of Concept

Applying this function at the end of /test/SantasListTest.t.sol to see how tokenUri string is constant for all tokens , minted or not

Ran with command: forge test --match-test testPoC_TokenURIReturnsDataForNonexistentNFT -vvvv

function testPoC_TokenURIReturnsDataForNonexistentNFT() public {
uint256 nonexistentTokenId = 999;
​
// No NFT has been minted, but metadata is still returned.
string memory uri = santasList.tokenURI(nonexistentTokenId);
​
assertEq(uri, santasList.TOKEN_URI());
​
// The token itself does not exist.
vm.expectRevert();
santasList.ownerOf(nonexistentTokenId);
}

Recommended Mitigation

Validate that the token exists before returning its metadata.

function tokenURI(uint256 tokenId) public view override returns (string memory) {
_requireOwned(tokenId);
return TOKEN_URI;
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 17 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!