Eggstravaganza

Vulnerability Details

The NFT is returned to the caller using eggNFT.transferFrom(address(this), msg.sender, tokenId). The transferFrom function does not check whether the recipient (msg.sender) can receive ERC721 tokens. If msg.sender is a contract that does not implement the onERC721Received function (required by ERC721’s safe transfer mechanism), the transfer will succeed, but the NFT may become inaccessible if the recipient contract cannot handle it. This contrasts with safeTransferFrom, which reverts if the recipient is a contract without proper ERC721 support.

Impact

Users who are contracts (e.g., a multisig wallet or another game contract) without onERC721Received implemented could inadvertently lock their NFTs. While this requires user error, it poses a risk of asset loss in a system where contract interactions are common.

Recommendations

I would replace transferFrom with safeTransferFrom in withdrawEgg