#fixed code
                                String assignToken(User user, int dashId, int deviceId, String newToken) {
        // Clean old token from cache if exists.
        DashBoard dash = user.profile.getDashByIdOrThrow(dashId);
        Device device = dash.getDeviceById(deviceId);

        String oldToken = removeOldToken(device);

        //todo should never happen. but due to back compatibility
        if (device == null) {
            throw new IllegalCommandBodyException("Error refreshing token for user + " + user.name);
        }

        //assign new token
        device.token = newToken;
        cache.put(newToken, new TokenValue(user, dashId, deviceId));

        user.lastModifiedTs = System.currentTimeMillis();

        log.debug("Generated token for user {}, dashId {}, deviceId {} is {}.", user.name, dashId, deviceId, newToken);

        return oldToken;
    }
#vulnerable code 
                                String assignToken(User user, int dashId, int deviceId, String newToken) {
        // Clean old token from cache if exists.
        DashBoard dash = user.profile.getDashByIdOrThrow(dashId);
        Device device = dash.getDeviceById(deviceId);

        String oldToken = removeOldToken(device);

        //assign new token
        device.token = newToken;
        cache.put(newToken, new TokenValue(user, dashId, deviceId));

        user.lastModifiedTs = System.currentTimeMillis();

        log.debug("Generated token for user {}, dashId {}, deviceId {} is {}.", user.name, dashId, deviceId, newToken);

        return oldToken;
    } 
                            #location 9 
                            #vulnerability type NULL_DEREFERENCE