First Flight #15: Mondrian Wallet

Summary

Contract can't receive NFTs sent with safeTransferFrom method

Vulnerability Details

The contract under consideration is designed to receive and store ERC721 tokens. However, certain smart wallets or contracts might utilize the safeTransferFrom method to send an NFT. The safeTransferFrom method checks for the implementation of the onERC721Received method when the recipient is a contract. This is to ensure that the recipient contract can appropriately handle ERC721 tokens.

Impact

This might lead to loss of value as NFTs sent wont be received.

Tools Used

Manual

Recommendations

Therefore, it's essential for the contract to extend the ERC721Holder contract from OpenZeppelin. The ERC721Holder contract has the onERC721Received method implemented, which allows the contract to correctly receive and store ERC721 tokens sent using safeTransferFrom. Do note that the current OZ implementation ERC721 includes a safeTransferFrom function.