Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Unsafe NFT Minting Can Lead to Permanent Token Loss in Non-NFT-Compatible Contracts

igorwarkocz

Summary

The EggstravaganzaNFT contract uses the unsafe _mint instead of _safeMint when creating new eggs. If a contract without any function execution capabilities (like a basic storage contract) plays the game and finds an egg, the NFT will be permanently locked in that contract with no possibility of recovery.

Vulnerability Details

When a player finds an egg in searchForEgg, the minting process uses the unsafe _mint:

// In EggHuntGame.searchForEgg:
if (random < eggFindThreshold) {
eggCounter++;
eggsFound[msg.sender] += 1;
eggNFT.mintEgg(msg.sender, eggCounter); // msg.sender could be a contract
emit EggFound(msg.sender, eggCounter, eggsFound[msg.sender]);
}
​
// In EggstravaganzaNFT.mintEgg:
function mintEgg(address to, uint256 tokenId) external returns (bool) {
require(msg.sender == gameContract, "Unauthorized minter");
_mint(to, tokenId); // Unsafe minting
totalSupply += 1;
return true;
}

A basic contract without any function execution capabilities can play the game.
If such a contract finds an egg, the NFT will be minted to its address
and without any functions to execute transfers or make external calls, the NFT will be permanently locked,
there would be no way to recover it.

Impact

MEDIUM severity because it can result in permanent and irreversible loss of NFTs, but only for a specific group of users.

Tools Used

Manual code review

Recommendations

Replace _mint with _safeMint in the mintEgg function. This change ensures that only contracts that explicitly support NFTs (by implementing onERC721Received) can receive them.

Updates

Lead Judging Commences

m3dython Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Unsafe ERC721 Minting

Protocol doesn't check if recipient contracts can handle ERC721 tokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.