Project

Summary

The MembershipERC1155 contract imports the OpenZeppelin Address library but does not utilize its safe call functions. Instead, the contract makes direct low-level calls, which can be unsafe and prone to errors.

Vulnerability Details

the MembershipERC1155 contract imports the OpenZeppelin Address library does not use the Address library's safe call functions, such as functionCall, functionCallWithValue, or functionStaticCall. Instead, it uses direct low-level calls, as seen in the `callExternalContract` function:

Impact

Direct low-level calls using .call do not provide safety checks and can lead to unexpected behavior if the called contract reverts or returns unexpected data.

Tools Used

Recommendations

• Replace direct low-level calls with the safe call functions provided by the Address library to ensure robust error handling and security checks.