Potential vulnerability of using `_transfer` and `_mint`
Summary
For minting and transferring NFTs, _transfer and _mint internal functions are used which is not an safe option.
Vulnerability Details
In 3 streaming contracts(linear, dynamic, and tranched), stream NFTs are created using _mint function, which is not safe and not recommended, because it does not call the callback function on the recipient if it's a contract.
Also in withdrawMaxAndTransfer function, _transfer is used rather than _safeTransfer.
Impact
Two impacts exist:
Incompatibility with marketplace because of missing hook calls.
Recipient contracts unaware of NFT transfers, which might lead to loss of NFTs, especially in smart contract wallets.
Tools Used
Manual Review
Recommendations
Rather than _transfer and _mint, _safeTransfer and _safeMint should be used.
Lead Judging Commences
Info/Gas/Invalid as per Docs
https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.