Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Use of `_mint` Instead of `_safeMint` for NFT Minting, causing loss of NFT for users which cannot receive ERC721's

jumpupjoran

Summary

The protocol mints the NFT's via _mint instead of safeMint function. The _mint function does not check weather or not the recipient can actually receive ERC721 token.

Vulnerability Details

In the EggstravaganzaNFT:mintEgg function, the contract uses _mint to create and assign ownership of NFTs without checking the compatibility of the recipient. This lack of validation could result in NFTs being sent to contracts that are not ERC721-compatible, causing them to be locked and inaccessible.

Impact

Using _mint instead of _safeMint could impact the user's experience, if users mistakenly use an incompatible contract, then they will not have access to the NFT, leading loss of Eggs, user dissatisfaction, or users with a limited knowledge about NFT's might event think this project is a scam.

Tools Used

static analysis

Recommendations

function mintEgg(address to, uint256 tokenId) external returns (bool) {
require(msg.sender == gameContract, "Unauthorized minter");
- _mint(to, tokenId);
+ _safeMint(recipient, tokenId);
totalSupply += 1;
return true;
}
Updates

Lead Judging Commences

m3dython Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Unsafe ERC721 Minting

Protocol doesn't check if recipient contracts can handle ERC721 tokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.