Submission Details
Severity:
Use _safeMint instead of _mint
Description
The contract uses _mint instead of _safeMint in GivingThanks::donate for NFT minting operations. This bypasses checks for whether the recipient can handle ERC721 tokens.
Impact
Tokens could be minted to contracts that don't support ERC721, leading to permanent loss of NFTs
Violates ERC721 safety best practices
Recommended mitigation
function donate(address charity) public payable {
require(registry.isVerified(charity), "Charity not verified");
(bool sent,) = charity.call{value: msg.value}("");
require(sent, "Failed to send Ether");
_safeMint(msg.sender, tokenCounter); // Use safeMint instead
string memory uri = _createTokenURI(msg.sender, block.timestamp, msg.value);
_setTokenURI(tokenCounter, uri);
tokenCounter += 1;
}
Rewards breakdown
nSLOC
67This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.