Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Consider _safemint

zanyelf191

Summary

The EggstravaganzaNFT.mintEgg() could be sent to address without ERC721 support.

Vulnerability Details

The mintEgg function calls _mint(to, tokenId):

function mintEgg(address to, uint256 tokenId) external returns (bool) {
require(msg.sender == gameContract, "Unauthorized minter");
_mint(to, tokenId);
totalSupply += 1;
return true;
}

_mint has the risk that minted eggs will be sent to addresses that are not set up to receive NFTs.

Impact

If users make guesses from addresses not set up to receive the NFT then those minted NFTs could be locked forever.

Tools Used

  • Manual review

Recommendations

The issue above could be an acceptable risk, as there's a trade-off to updated _mint() to _safeMint().

If the code is changed to use _safeMint() it will protect against locked NFTs, but then requires that the searchForEgg() function has reentrancy protection added to it.

Updates

Lead Judging Commences

m3dython Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Unsafe ERC721 Minting

Protocol doesn't check if recipient contracts can handle ERC721 tokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.