Juicebox contest - joestakey's results

Lines of code

https://github.com/jbx-protocol/juice-nft-rewards/blob/f9893b1497098241dd3a664956d8016ff0d0efd0/contracts/JBTiered721Delegate.sol#L140

Vulnerability details

JBTiered721Delegate inherits from JB721Delegate, which inherits from ERC721

It implements JBTiered721Delegate.tokenURI(), a function overriding ERC721's tokenURI().

This function returns the metadata URI of the provided token ID.

The issue is that if queried for a token that does not have an owner or has not been minted, it returns the empty string ''.

This breaks compliance with EIP721, ERC721Metadata.which states that tokenURI():

Throws if `_tokenId` is not a valid NFT

Impact

It opens a risk for contracts that would interact with JBTiered721Delegate and query tokenId() - for instance to check contributors of a project, if a function performs some logic based on the tokenURI of a tokenId and expects the call to revert if queried for an unminted token.

Tools Used

Manual Analysis

Mitigation

Have the function JBTiered721Delegate.tokenURI() revert if queried for a tokenId that has not been minted yet.

+          _requireMinted(tokenId);
-140:      if (_owners[_tokenId] == address(0)) return '';