First Flight #10: One Shot

Summary

The Streets impletements IERC721Receiver and IERC721Receiver.onERC721Received.selector for safeTransfers but it doesn't use that. The RapBattle does not impletement IERC721Receiver and IERC721Receiver.onERC721Received.selector

Vulnerability Details

It must return its Solidity selector to confirm the token transfer.
If any other value is returned or the interface is not implemented by the recipient, the transfer will be reverted.

Impact

Not safe transfers will be reverted

Tools Used

Testing with Remix

Recommendations

Change transferFrom to safeTransferFrom calls in the Streets.sol (and RapBattle) for oneShotContract calls. Add onERC721Received implementation to the RapBattle to accept ERC721 tokens with safeTransferFrom calls instead of transferFrom.