Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

_mint inside of eggMint() can lead to lost NFT's

ygorz

Summary

Using "mint" rather than _"_safeMint" can lead to minting egg NFT's to contracts that aren't set up to handle ERC-721 tokens.

Vulnerability Details

Inside of the 'eggMint()' function in the EggstravaganzaNFT.sol contract, the minting is done with the call to "mint". This doesn't do a check if the receiving contract is equipped to receive and manage ERC-721 tokens.

This could lead to lost NFT's as the receiver won't be able to get them. A better method would be to use "_safeMint" instead, which will do a check on the receiving contract to see if they have implemented the onERC721Received interface, lessening the chance of sending NFT's to an incompatible receiver.

Impact

Minted NFT's that will be wasted as they can't be handled by the receiver.

Tools Used

Manual review.

Recommendations

Inside of the eggMint() function in the EggstravaganzaNFT.sol contract, change "_mint_"_ to "_safeMint" so the full function looks like:

function mintEgg(address to, uint256 tokenId) external returns (bool) {
require(msg.sender == gameContract, "Unauthorized minter");
_safeMint(to, tokenId);
totalSupply += 1;
return true;
}
Updates

Lead Judging Commences

m3dython Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Unsafe ERC721 Minting

Protocol doesn't check if recipient contracts can handle ERC721 tokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.