Mint NFT should check msg.sender is allowed to receive one.
Summary
In some cases, user can use a contract to interact with contracts.
When user build a contract to interact with SpookySwap, they should make sure the contract they built can receive NFT.
Or the NFT will be stuck forever.
Vulnerability Details
If a contract call this trickOrTreat function and successfully mint one NFT
but this contract doesn't implement the function to deal with NFT.
Then this NFT will stuck in this contract.
refer
Impact
Likelihood would be medium/low, severity might be medium/low.
If this issue happens, the NFT will stuck in a contract which can not do anything to transfer it.
Tools Used
Manually
Recommendations
instead of using _mint, using _safeMint will be a better way.
In _safeMint function, it will check the receiver has a onERC721Received function.
At least it provide a minimum level of protection.
Appeal created
Use of `_mint` instead of `safeMint`
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.