Eggstravaganza

Summary

It’s advisable to opt for safeTransferFrom() instead of transferFrom() when sending ERC721 tokens from the vault to external address

Vulnerability Details

Currently, the contract uses transferFrom() instead of safeTransferFrom() — presumably to reduce gas costs. However, this approach has its drawbacks. According to OpenZeppelin’s ERC721 documentation, using safeTransferFrom() is the much preferred method. It adds additional safety checks that transferFrom() lacks.

Impact

Although the risk is minimal in this case (since the recipient is the transaction initiator), there remains a chance that tokens could be permanently lost if sent to a contract that doesn’t support ERC721 transfers correctly.

Recommendations

Use safeTransferFrom() when sending out the NFT from the vault.