Unsafe use of `_mint` instead of `_safeMint` in EggstravaganzaNFT.sol
Summary
Unsafe use of _mint instead of _safeMint in EggstravaganzaNFT.sol(https://github.com/CodeHawks-Contests/2025-04-eggstravaganza/blob/main/src/EggstravaganzaNFT.sol#L29)
Vulnerability Details
The usage of _safeMintguarantees that the receiver toaddress is either a smart contract that implements IERC721Receiver.onERC721Receivedor an EOA.
Impact
Using _mint instead of _safeMint can cause NFTs to be lost if sent to a smart contract that doesn't support receiving ERC721 tokens. _mint skips safety checks, which may result in tokens being locked or inaccessible. This can lead to user asset loss and reduces the reliability of the contract.
Tools Used
Manual analyzed
Recommendations
According to OpenZeppelin usage of _mintis discouraged,use _safeMintwhenever possible.
See the docs: https://docs.openzeppelin.com/contracts/4.x/api/token/erc721#ERC721-_safeMint-address -uint256-
Lead Judging Commences
Unsafe ERC721 Minting
Protocol doesn't check if recipient contracts can handle ERC721 tokens
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.