Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Missing ERC721 Receiver Implementation Causes NFT Minting Failures

osuolale

Summary

Vulnerability Details

The createEstateNFT function in InheritanceManager fails to properly handle NFT minting due to mismatched ERC721 implementation patterns.

  1. Minting Mechanism Mismatch
    The NFTFactory contract uses _mint instead of _safeMint from OpenZeppelin's ERC721 implementation:

    // NFTFactory.sol
    function createEstate(...) external {
    _mint(msg.sender, ID); // Uses basic mint
    }

    However, the InheritanceManager contract attempts to act as an NFT custodian without proper ownership tracking.

  2. Ownership Tracking Failure
    The InheritanceManager never explicitly tracks which NFTs it owns, creating potential mismatches between the nftValue mapping and actual on-chain ownership.

  3. Call Flow Vulnerability
    Sequence diagram showing the flawed interaction:

    mermaid

    Copy

    sequenceDiagram
    InheritanceManager->>NFTFactory: createEstate()
    NFTFactory->>ERC721: _mint(InheritanceManager, ID)
    ERC721-->>NFTFactory: Mint success
    NFTFactory-->>InheritanceManager: Return ID
    InheritanceManager->>Self: Store nftValue[ID]

    Missing validation that InheritanceManager actually received the NFT.

Impact

  • Failed NFT Minting: All calls to createEstateNFT() will revert with error:
    ERC721: transfer to non ERC721Receiver implementer

  • Broken Core Functionality: Real-world asset tokenization (the contract's primary purpose) becomes unusable

  • Permanent State Corruption: Subsequent functions relying on NFT ownership will behave unpredictably

  • Silent Failures: Transactions may succeed without actual NFT ownership

  • Data Corruption: nftValue mapping entries could reference non-existent NFTs

  • Asset Loss: Contracts may appear to create NFTs that never materialize

Tools Used

Manual Review

Recommendations

Use Safe Mint Pattern

// NFTFactory.sol
function createEstate(...) external {
_safeMint(msg.sender, ID); // Add receiver check
}

Implement ERC721 Receiver Interface

Add to InheritanceManager:

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;
​
import {IERC721Receiver} from "@openzeppelin/contracts/token/ERC721/IERC721Receiver.sol";
​
contract InheritanceManager is IERC721Receiver {
function onERC721Received(
address, /*operator*/
address, /*from*/
uint256, /*tokenId*/
bytes calldata /*data*/
) external pure override returns (bytes4) {
return this.onERC721Received.selector;
}
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Missing ERC721 Receiver

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.