Pieces Protocol

Summary

The claimNft function in Solidity allows a user to claim an NFT (non-fungible token) under certain conditions.

Vulnerability Details

The NftClaimedevent is before transfer the NFTs tokens.

IERC721(nftAddress).safeTransferFrom(address(this), msg.sender, tokenInfo.tokenId);

Impact

If the event is emitted before the actual transfer of the NFT, it might lead to a situation where the event log indicates that a transfer has occurred, even though it may have failed. This can result in misleading records about the state of the contract.

Tools Used

manual review

Recommendations

The emit NftClaimed(nftAddress) statement should be placed after the safeTransferFrom method to ensure the NFT has been successfully transferred before emitting the event.

Please check example: