`EggstravaganzaNFT::mintEgg` using `ERC721::_mint`, not `ERC721::_safeMint`
Summary
The EggstravaganzaNFT::mintEgg calls the ERC721::_mint function, not ERC721::_safeMint. This does not check whether the to address is capable of receiving the NFT, in this case msg.sender, which may lead to loss of the NFT.
Vulnerability Details
The EggstravaganzaNFT::mintEgg function calls the ERC721::_mint function, which does not call IERC721Receiver(to).onERC721Received(). As a result, there is no check whether the NFT can be recieved and is lost if the transfer fails.
Impact
This could lead to the permanent loss of the NFT if the transfer is unsuccessful.
Tools Used
Manual review.
Recommendations
Replace the use of _mint with _safeMint.
Lead Judging Commences
Unsafe ERC721 Minting
Protocol doesn't check if recipient contracts can handle ERC721 tokens
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.