Zaros Part 1

Summary

This report outlines the issues found in the use of the _mint function within two smart contract files: AccountNFT.sol and USDToken.sol. The usage of the _mint function instead of the _safeMint function can result in minting ERC721 tokens to addresses that do not support ERC721 tokens, leading to potential token loss or other unintended behavior.

Vulnerability Details

File: src/account-nft/AccountNFT.sol

• Line: 20

• Code Snippet

File: src/usd/USDToken.sol

• Line: 17

• Code Snippet

Impact

• Token Loss: Minting to addresses that do not support ERC721 tokens can cause tokens to become inaccessible or lost.

• Non-compliance: Failing to adhere to standards may lead to issues in interacting with other smart contracts and DAOs, potentially breaking automated systems and workflows.

• Security Risks: Addresses that fail to handle tokens correctly may introduce vulnerabilities or weaknesses in the token system, potentially leading to exploitation.

Tools Used

Manual review

Recommendations

To mitigate the risks associated with using _mint(), replace it with _safeMint() from the ERC721 standard. The _safeMint() function checks that the receiving address is aware of the ERC721 protocol to prevent tokens from being sent to contracts that are not capable of handling them.

Here are the suggested code modifications:

In src/account-nft/AccountNFT.sol:
Replace:

With:

In src/usd/USDToken.sol:
Ensure that the logic aligns with ERC20 standards if _mint() is intended for ERC20 token minting. If the function is supposed to mint ERC721 tokens, change it to _safeMint(). If it’s for ERC20, review and confirm if potential _mint() usage risks in that context. If ERC721: Replace:

With: