Description: Using ERC721::_mint() allows minting tokens to any address, including contracts that do not implement the IERC721Receiver interface. If a token is minted to a smart contract that does not properly handle ERC721 tokens, the token may become permanently inaccessible or locked. The _safeMint() function performs additional checks to ensure the recipient is capable of receiving ERC721 tokens.

Impact: Tokens might get locked in contracts that are not designed to handle ERC721 tokens, resulting in permanent loss of assets. This could also cause unexpected behavior and poor user experience.

Proof of Concept:

This call will succeed even if the recipient is not a valid ERC721 receiver contract!

Recommended Mitigation: Use _safeMint() instead of _mint() in EggstravaganzaNFT::mintEgg function when minting ERC721 tokens to ensure the receiving contract is able to handle the tokens correctly:

This ensures that if msg.sender is a contract, it must implement the onERC721Received interface, otherwise the mint will revert.