Trick or Treat

Summary

Smart contract wallets players, using _mint / _transfer functions from ERC721, may lead to being forever locked tokens in contract.

Vulnerability Details

_mint / _transfer functions do not check whether the to address is capable of handling ERC-721 tokens. If the to address is a smart contract and it does not implement the IERC721Receiver interface, the token could get stuck in that contract, and it may not be retrievable.

Impact

If recipient wallet doesn't support ERC721 standard, and call _mint / _transfer function from ERC721, token will be locked forever.

Tools Used

Manual

Recommendations

Instead of using _mint / _transfer functions, use _safeMint / _safeTransfer functions from the same Openzeppelin library. Before transferring the token, _safeMint / _safeTransfer checks if the to address is a contract. If it is, the contract must implement IERC721Receiver.onERC721Received to handle the token correctly. This prevents the token from being transferred to a contract that can't manage ERC-721 tokens.