Submitted by cccz
ProfilePicture.getPFP will return information about the underlying NFT and when addressRegistry.getAddress(cidNFTID) ! = ERC721(nftContract).ownerOf(nftID), it will return 0.
But if the underlying NFT is burned, getPFP may return incorrect information
Consider the following scenario.
When integrating with other projects, there may be bugs because getPFP returns an incorrect result.
https://github.com/code-423n4/2023-03-canto-identity/blob/077372297fc419ea7688ab62cc3fd4e8f4e24e66/canto-pfp-protocol/src/ProfilePicture.sol#L94-L105
https://github.com/code-423n4/2023-03-canto-identity/blob/077372297fc419ea7688ab62cc3fd4e8f4e24e66/canto-identity-protocol/src/AddressRegistry.sol#L86-L92
Change to
OpenCoreCH (Canto Identity) confirmed and commented:
