Smart contract wallets players, using `_mint` function from `ERC721` in `GivingThanks::donate` function, may lead to being forever locked tokens in contract.
Summary
_mint function does not check whether the to address is capable of handling ERC-721 tokens.
Vulnerability Details
_mint function does not check whether the to address is capable of handling ERC-721 tokens. If the to address is a smart contract and it does not implement the IERC721Receiver interface, the token could get stuck in that contract, and it may not be retrievable.
Impact
If recepient wallet doesn't support ERC721 standard, and call _mint function from ERC721, token will be locked forever.
Tools Used
Manual
Recommendations
Instead of using _mint function, use _safeMint function from the same Openzeppelin library. Before transferring the token, _safeMint checks if the to address is a contract. If it is, the contract must implement IERC721Receiver.onERC721Received to handle the token correctly. This prevents the token from being transferred to a contract that can't manage ERC-721 tokens.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.