Snowman Merkle Airdrop

Root + Impact

Description

• The tokenURI function checks if (ownerOf(tokenId) == address(0)) to detect non-existent tokens and revert with a custom error ERC721Metadata__URI_QueryFor_NonExistentToken.

• However, in OpenZeppelin's ERC721 implementation (v5, used with Solidity ^0.8.24), the ownerOf function already reverts with ERC721NonexistentToken(tokenId) when the token does not exist. It never returns address(0).

• This means the custom check is dead code — it can never evaluate to true. The custom error ERC721Metadata__URI_QueryFor_NonExistentToken is never reachable.

Risk

Likelihood:

• The dead code is present in every deployment of the contract, though it causes no direct harm.

Impact:

• When tokenURI is called with a non-existent tokenId, users receive OpenZeppelin's generic ERC721NonexistentToken error instead of the contract's intended custom error ERC721Metadata__URI_QueryFor_NonExistentToken.

• This is misleading for developers and integrators who expect the custom error to be used.

• The dead code adds unnecessary bytecode size and gas cost during deployment.

Proof of Concept

In OpenZeppelin v5's ERC721, the ownerOf function calls _requireOwned(tokenId), which reverts if the token owner is address(0). This means ownerOf either returns a valid non-zero address or reverts — it never returns address(0).

Recommended Mitigation

Replace the ownerOf check with OpenZeppelin's internal _ownerOf function, which returns address(0) for non-existent tokens without reverting. This allows the custom error to work as intended. Alternatively, remove the custom check entirely and rely on OpenZeppelin's built-in revert.