First Flight #10: One Shot

Summary

transferFrom is used instead of safeTransferFrom which is not recommended.

Vulnerability Details

Currently transferFrom is used when a user is staking / unstaking or going on stage. Most likely it's being used for saving some gas.

But this is not a recommended method and should be avoid as per Official OpenZeppelin documentation.

As staking contract has correctly implemented the IERC721Receiver, so using safeTransferFrom makes more sense. As per current transferFrom, the onERC721Received won't be triggered.

Impact

unable to use onERC721Received hook, which is not a recommended.

Tools Used

Manual Review

Recommendations

use safeTransferFrom instead of transferFrom in highlighted smartcontracts