Submission Details
Severity:
[M-2] `Streets` implements `IERC721Receiver` and allows users to lose their NFT if `IOneShot::safeTransferFrom()` is called
Description
ERC721::onERC721Received() is called by ERC721::safeTransferFrom() or ERC721::_safeMint(). For users to earn CRED, they need to transfer their NFT to Streets through Streets::stake()
Impact
Sending an NFT by calling IOneShot::safeTransferFrom() would mean losing the NFT
Recommended Mitigation
- import "@openzeppelin/contracts/token/ERC721/IERC721Receiver.sol";
- contract Streets is IERC721Receiver {
+ contract Streets {
.
.
.
- function onERC721Received(address, address, uint256, bytes calldata) external pure override returns (bytes4) {
- return IERC721Receiver.onERC721Received.selector;
- }
}
Rewards breakdown
nSLOC
201This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.