Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Tokens Can Be Permanently Lost When Minted to Smart Contracts

grands9n47

Summary

The mintEgg function allows the game contract to mint new NFT eggs by calling the internal _mint function from the ERC721 standard. However, it uses _mint instead of _safeMint, which can cause NFTs to be sent to contracts that do not know how to handle them. This can result in NFTs getting stuck and permanently lost if the receiving contract does not implement the onERC721Received interface.

Vulnerability Details

The function allows minting of NFT eggs to any address, including smart contracts. However, since it uses _mint instead of _safeMint, there is no check to see if the receiving contract can handle NFTs. If an egg is minted to a contract that does not support the onERC721Received function, the egg will be locked forever, as the contract won't be able to transfer or interact with it properly. This is especially risky if the game or vault interacts with other contracts.

function mintEgg(address to, uint256 tokenId) external returns (bool) {
require(msg.sender == gameContract, "Unauthorized minter");
_mint(to, tokenId);
totalSupply += 1;
return true;
}

Impact

  • NFTs can be permanently lost if minted to a smart contract that can't handle them.

  • Players or vault systems could lose assets due to the improper use of _mint.

  • This results in poor user experience and asset mismanagement.

Tools Used

Manual review

Recommendations

Replace _mint with _safeMint in the mintEgg function to ensure that tokens are only minted to addresses that can receive and manage NFTs.

Updates

Lead Judging Commences

m3dython Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Unsafe ERC721 Minting

Protocol doesn't check if recipient contracts can handle ERC721 tokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.