GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Using `_mint` instead of `_safeMint` in `GivingThanks::donate` function may cause NFTs sent to contracts to be irretrievable locked

phylax

Summary

In GivingThanks::donate function the _mint function is used to mint a new NFT without performing safety checks to ensure that the recipient address can handle ERC721 tokens.

Vulnerability Details

_mint function does not verify if the recipient implements the IERC721Recieverinterface which is necessary for contracts to safely recieve ERC721 tokens.

function donate(address charity) public payable {
require(registry.isVerified(charity), "Charity not verified");
(bool sent,) = charity.call{value: msg.value}("");
require(sent, "Failed to send Ether");
​
@> _mint(msg.sender, tokenCounter);
​
// Create metadata for the tokenURI
string memory uri = _createTokenURI(msg.sender, block.timestamp, msg.value);
_setTokenURI(tokenCounter, uri);
​
tokenCounter += 1;
}

Impact

If a recipient address is a smart contract that does not have the IERC721Recieverinterface implemented the NFT could become permenantly locked in because the contract may not have the necessary logic to handle the NFT leading to the user losing access to the NFT.

Tools Used

Manual code review

Recommendations

Use safeMintfunction instead of _mintfunction.

function donate(address charity) public payable {
require(registry.isVerified(charity), "Charity not verified");
(bool sent,) = charity.call{value: msg.value}("");
require(sent, "Failed to send Ether");
​
+ _safeMint(msg.sender, tokenCounter);
- _mint(msg.sender, tokenCounter);
​
// Create metadata for the tokenURI
string memory uri = _createTokenURI(msg.sender, block.timestamp, msg.value);
_setTokenURI(tokenCounter, uri);
​
tokenCounter += 1;
}
Updates

Lead Judging Commences

n0kto Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.