Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

### [L-2] `Snowman::tokenURI` ownership check can never trigger

symmate

Description: tokenURI guards against non-existent tokens with if (ownerOf(tokenId) == address(0)). However, OpenZeppelin's ERC721 implementation causes ownerOf to revert for non-existent tokens rather than returning address(0), so the custom error ERC721Metadata__URI_QueryFor_NonExistentToken is unreachable.

Impact: The intended guard is ineffective; the custom error is dead code.

Recommended Mitigation: Use _ownerOf (internal) which returns address(0) for non-existent tokens, or use _exists(tokenId).

- if (ownerOf(tokenId) == address(0)) {
+ if (_ownerOf(tokenId) == address(0)) {
revert ERC721Metadata__URI_QueryFor_NonExistentToken();
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 2 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!