GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Incorrect Usage of mint instead of safeMint in GivingThanks Contract

bryanconquer

Summary

The contract uses the mint function to mint new tokens instead of safeMint, which is the recommended approach in ERC721 contracts. Using safeMint ensures that tokens are only minted to addresses capable of handling them, thereby preventing tokens from being sent to contracts that do not support ERC721.

Vulnerability Details

function mintToken(address recipient, string memory tokenURI) public {
require(registry.isVerified(msg.sender), "Not a verified charity");
_mint(recipient, tokenCounter); // @audit should use safeMint
_setTokenURI(tokenCounter, tokenURI);
tokenCounter++;
}
​

Impact

Impact: Using _mint can lead to issues if the recipient address is a contract that does not support receiving ERC721 tokens, potentially causing tokens to be permanently locked.

Tools Used

manual review

Recommendations

Replace _mint with _safeMint in the mintToken function.

function mintToken(address recipient, string memory tokenURI) public {
require(registry.isVerified(msg.sender), "Not a verified charity");
_safeMint(recipient, tokenCounter); // Use safeMint for better compatibility
_setTokenURI(tokenCounter, tokenURI);
tokenCounter++;
}
​
Updates

Lead Judging Commences

n0kto Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Appeal created

bryanconquer Submitter
12 months ago
n0kto Lead Judge
12 months ago
n0kto Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.