Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Unsafe ERC721 Token Minting in NFTFactory Contract and Lack Of onERC721Received in InheritanceManager Contract

0xblackadam

Finding description and impact

The NFTFactory contract used by InheritanceManager is minting ERC721 tokens in an unsafe manner. The contract uses the _mint() function instead of _safeMint() when creating new estate NFTs. While this doesn't cause immediate transaction failures, it violates the ERC721 safety standards.

The impact is that:

  • The contract doesn't validate whether the recipient is capable of handling ERC721 tokens

  • If the contract implementation changes or is extended in the future, NFTs could be locked forever

  • This violates ERC721 standards which recommend using _safeMint() for contract recipients

  • Future integrations might assume standard compliance and fail

Recommended mitigation steps

To fix this issue, implement both of the following changes:

  1. Update the NFTFactory contract to use _safeMint() instead of _mint():

function createEstate(string memory description) external onlyInheritanceManager returns (uint256 itemID) {
uint256 ID = _incrementCounter();
_safeMint(msg.sender, ID); // Changed from _mint to _safeMint
_setTokenURI(ID, description);
return ID;
}

  1. Implement the IERC721Receiver interface in the InheritanceManager contract:

import {IERC721Receiver} from "@openzeppelin/contracts/token/ERC721/IERC721Receiver.sol";
​
contract InheritanceManager is Trustee, IERC721Receiver {
// Existing code...
function onERC721Received(
address operator,
address from,
uint256 tokenId,
bytes calldata data
) external override returns (bytes4) {
return this.onERC721Received.selector;
}
}

These changes ensure that the system follows the ERC721 standard's safe transfer practices and properly validates token reception.

Tools Used

  • Foundry Testing Framework

  • Manual Code Review

Updates

Lead Judging Commences

0xtimefliez Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Missing ERC721 Receiver

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.