Trick or Treat

Description:

The contract uses the _mint function to create new ERC721 tokens, which does not check if the recipient is capable of receiving ERC721 tokens.

Instances:

1. Minting to Contract Itself (Line 81):

   _mint(address(this), tokenId);

2. Minting to Recipient (Line 110):

   _mint(recipient, tokenId);

Impact:

• Potential Token Loss:

  • If tokens are minted to a contract that does not implement the onERC721Received function, they could become permanently locked, leading to loss of tokens.

• Compliance with ERC721 Standard:

  • The ERC721 standard recommends using _safeMint to ensure safe transfers to contracts.

Recommendation:

• Use _safeMint Function:

  • Replace _mint with _safeMint to include safety checks.

  • Updated Minting to Contract Itself:

    _safeMint(address(this), tokenId);

  • Updated Minting to Recipient:

    _safeMint(recipient, tokenId);

• Handle Potential Reverts:

  • Be prepared for the possibility that _safeMint may revert if the recipient cannot handle ERC721 tokens.

• Inform Users:

  • Clearly communicate to users that their addresses must be capable of receiving ERC721 tokens, especially if they are using smart contract wallets.