Submission Details
Severity:
Use of `_mint` instead of `_safeMint`.
Summary
The contract GivingThanks uses the _mint function in function donateto create new ERC721 tokens, which does not check if the recipient is capable of receiving ERC721 tokens.
Vulnerability Details
function donate(address charity) public payable {
require(registry.isVerified(charity), "Charity not verified"); // @audit-issue can donate to unverified charity
(bool sent, ) = charity.call{value: msg.value}("");
require(sent, "Failed to send Ether");
- _mint(msg.sender, tokenCounter);
Impact
If tokens are minted to a contract that does not implement the onERC721Received function, they could become permanently locked, leading to loss of tokens.
Tools Used
Manual code review.
Recommendations
Use _safeMint Function:
function donate(address charity) public payable {
require(registry.isVerified(charity), "Charity not verified"); // @audit-issue can donate to unverified charity
(bool sent, ) = charity.call{value: msg.value}("");
require(sent, "Failed to send Ether");
+ _safeMint(msg.sender, tokenCounter);
Rewards breakdown
nSLOC
67This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.