Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Use `_safeMint(address, uint256)` instead of `_mint(address, uint256)` in the `EggstravaganzaNFT::mintEgg()` function

luongtrongdai

Description: In smart contract audits, especially for ERC721 (NFT) tokens, using _safeMint instead of _mint is a recommended practice to ensure the recipient is a contract that implements the onERC721Received hook, enhancing security and preventing potential issues.

Impact:

  • Security: _safeMint() ensures that the recipient contract can properly handle the newly minted token, preventing potential issues or vulnerabilities.

  • Contract Compatibility: It verifies that the recipient contract is compatible with ERC721 standards, ensuring proper token transfer and management.

Recommended Mitigation:

function mintEgg(address to, uint256 tokenId) external returns (bool) {
require(msg.sender == gameContract, "Unauthorized minter");
- _mint(to, tokenId);
+ _safeMint(to, tokenId);
totalSupply += 1;
return true;
}
Updates

Lead Judging Commences

m3dython Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Unsafe ERC721 Minting

Protocol doesn't check if recipient contracts can handle ERC721 tokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.