DittoETH

Summary

After minting is completed _checkOnERC721Received() is not called to verify if the target address which is the msg.sender implements {IERC721Receiver-onERC721Received}

Vulnerability Details

The ERC721 implementation used by the ERC721 facet contract does not properly call the corresponding callback when new tokens are minted. However The ERC721 standard states that the onERC721Received callback must be called when a Safemint or Safetransfer operation occurs which is ideal to prevent tokens from being stuck in a contract. However, the smart contracts interacting as users of the contracts will not be notified with the onERC721Received callback, as expected according to the ERC721 standard.

Impact

As a result of the mintNFT() not implementing the onERC71Received callback correctly when tokens are minted, it can lead to tokens being stuck in the target address if it is a contract.

Tools Used

Manual Review

Recommendations

Ensure that the ERC721 implementations execute the standard callback when they are required and also review all ERC standards to ensure that the contracts implement them correctly.