Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Using `_mint` in `EggstravaganzaNFT::mintEgg` can cause NFT loss when the receiver is a contract that doesn't implement `ERC721Receiver`

nebosvod

Description: _mint is a function that doesn't take into account whether the receiver address can receive the specified tokens. So a contract that calls the EggHuntGame::searchForEgg function and finds an egg, tries to mint it in EggstravaganzaNFT::mintEgg with _mint but doesn't have the ERC721Receiver contract implemented, won't be able to receive the NFT and the NFT will be lost.

Impact: Minted NFT tokens will be lost when the EggstravaganzaNFT::mintEgg tries to mint them to a contract that can't receive the tokens.

Recommended Mitigation: It's recommended to use the _safeMint function instead of _mint when minting new tokens to ensure the NFT token won't be lost if the receiver can't actually receive NFTs.

function mintEgg(address to, uint256 tokenId) external returns (bool) {
require(msg.sender == gameContract, "Unauthorized minter");
- _mint(to, tokenId);
+ safeMint(to, tokenId);
totalSupply += 1;
return true;
}
Updates

Lead Judging Commences

m3dython Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Unsafe ERC721 Minting

Protocol doesn't check if recipient contracts can handle ERC721 tokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.