Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Use of _mint() instead of _safeMint()

avalance

Summary

The contract uses _mint() to mint NFTs, which can cause problems if the recipient is a smart contract that can't handle ERC721 tokens.

Vulnerability Details

In the function mintEgg(address to, uint256 tokenId), the _mint() function is used:

function mintEgg(address to, uint256 tokenId) external returns (bool) {
require(msg.sender == gameContract, "Unauthorized minter");
_mint(to, tokenId);
totalSupply += 1;
return true;
}

This does not check if the to address is a smart contract that supports receiving NFTs. If the recipient is a contract and does not implement onERC721Received(), the NFT will be permanently stuck.

Impact

The NFT can be locked in an unusable state if sent to an incompatible smart contract. This leads to loss of access for users and potential financial impact if the NFT holds value.

Tools Used

  • Manual Code Review

  • ERC721 DOCs

Updates

Lead Judging Commences

m3dython Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Unsafe ERC721 Minting

Protocol doesn't check if recipient contracts can handle ERC721 tokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!