Summary

The contract uses transferFrom() for NFT withdrawals, which does not handle ERC721 safety checks.

Vulnerability Details

• If the receiving address is a contract and does not support ERC721, the NFT might get stuck.

Impact

• NFTs could become unrecoverable if withdrawn to a non-ERC721-compliant contract.

Tools Used

• Manual review.

Recommendations

• Use safeTransferFrom() instead of transferFrom():

  eggNFT.safeTransferFrom(address(this), msg.sender, tokenId);