Dria
Swan
NFTHardhat
21,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

SwanAsset.sol use _mint instead of safeMint

bhunter

Summary

The deploy() function of SwanAssetFactory creates instances of SwanAsset. When an asset(Nft) is created _mint() function is called, however this may lead to the nft to be frozen if msg.sender is a contract not supporting ERC721.

Vulnerability Details

Any user can create an asset by calling list, which make a call to deploy function on SwanAssetFactory. The deploy() allows creating swan asset. however when creating an asset _mint function is used. If the _owner is a contract does not support ERC721, The asset will be locked.

As per the documentation of EIP-721:

A wallet/broker/auction application MUST implement the wallet interface if it will accept safe transfers.

Ref: https://eips.ethereum.org/EIPS/eip-721

As per the documentation of ERC721.sol by Openzeppelin:

Ref: https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC721/ERC721.sol#L274-L285

* @dev Mints `tokenId` and transfers it to `to`.
*
* WARNING: Usage of this method is discouraged, use {_safeMint} whenever possible
*
* Requirements:
*
* - `tokenId` must not exist.
* - `to` cannot be the zero address.
*
* Emits a {Transfer} event.
*/
function _mint(address to, uint256 tokenId) internal virtual {

Impact

Lock of Asset

Tools Used

Manual Review

Recommendations

Use safeMint instead of mint to make sure the receiver supports ERC721

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!