Summary

Cred Tokens are minted using ERC721._mint() which is not safe.

Vulnerability Details

• Found in CredToken::mint()

  function mint(address to, uint256 amount) public onlyStreetContract {

  _mint(to, amount);

  }

Impact

Using ERC721::_mint() can mint ERC721 tokens to addresses which don't support ERC721 tokens.

Tools Used

Aderyn

Recommendations

Use _safeMint() instead of _mint() for ERC721.