Core Contracts

Description:
The mint function in the contract accepts payments in ERC-20 tokens from users. It transfers the specified _amount of tokens from the user to the contract address to facilitate the minting process. However, the contract lacks a withdrawal mechanism, meaning that the collected funds remain locked within the contract with no way for the owner or an authorized entity to retrieve them.

Impact:

• Locked Funds Risk: The contract accumulates ERC-20 tokens without any means to transfer them out, leading to a scenario where the collected funds are inaccessible.

• Loss of Revenue: Without a withdrawal function, the project team cannot utilize the collected funds, effectively losing the intended revenue.

• Potential Governance Risks: If no upgradeability or ownership controls exist, these funds could be permanently stuck in the contract.

Proof of Concept:

1. A user calls the mint function with a _tokenId and _amount of ERC-20 tokens.

2. The contract checks the required price for the _tokenId.

3. If the _amount is sufficient, the contract transfers _amount of ERC-20 tokens from the user's wallet to the contract address.

4. The contract mints the NFT and assigns it to the user.

5. If the _amount exceeds the price, the excess tokens are refunded to the user.

6. The contract retains the collected ERC-20 tokens without any mechanism to withdraw them.

7. Over time, the contract accumulates ERC-20 tokens that cannot be accessed, leading to locked funds.

Recommended Mitigation:

1. Implement a Withdrawal Function: A secure withdrawal function should be added to allow an authorized entity (e.g., the contract owner) to retrieve the accumulated funds. Example implementation:

1. Utilize a Treasury or Payment Splitter Contract: Instead of storing the tokens in the NFT contract, they should be sent directly to a designated treasury or revenue-sharing contract for better fund management.

2. Access Control: Ensure only authorized addresses can call the withdrawal function to prevent unauthorized fund transfers.

By implementing these fixes, the contract will ensure that collected funds remain accessible, preventing revenue loss and governance issues.