Submission Details
Severity:
Unsafe NFT Minting with "_mint" for donors who do not support ERC721Receiver
Summary
In GivingThanks:donate, the _mint function mints and transfers tokens to recipients regardless of whether they implement ERC721Receiver.
Vulnerability Details
Within the GivingThanks:donate, the function _mint is called which transfers tokens to recipients regardless of wether they support ERC721Receiver, that if the donor do not handle ERC721 tokens, they will be completely loss.
function donate(address charity) public payable {
require(registry.isVerified(charity), "Charity not verified");
(bool sent,) = charity.call{ value: msg.value }("");
require(sent, "Failed to send Ether");
@> _mint(msg.sender, tokenCounter);
string memory uri = _createTokenURI(msg.sender, block.timestamp, msg.value);
_setTokenURI(tokenCounter, uri);
tokenCounter += 1;
}
Impact
Permanent loss of tokens with the donors if they do not implement ERC721Receiver
Tools Used
Recommendations
use
_safeMintinstead of_mint.
Rewards breakdown
nSLOC
67This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.