The ownerOf function requires checking if the owner is non-zero.

[code423n4]

Handle

shw

Vulnerability details

Impact

According to the eip-721 standard, the function ownerOf should throw if the owner is a zero address. However, this check is not implemented in the Beebots contract.

Proof of Concept

Referenced code:
(Beebots.sol#L285-L287)[https://github.com/code-423n4/2021-04-redacted/blob/main/Beebots.sol#L285-L287]

Tools Used

None

Recommended Mitigation Steps

Add a check require(owner != address(0)) after line 286 with proper revert message.