Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Using `_mint()` instead of `_safeMint()` may cause NFTs to be permanently lost

jfornells

Description:

The EggstravaganzaNFT::mintEgg function uses the internal _mint() method to create new NFTs:

function mintEgg(address to, uint256 tokenId) external returns (bool) {
require(msg.sender == gameContract, "Unauthorized minter");
@> _mint(to, tokenId);
totalSupply += 1;
return true;
}

While this works for externally owned accounts (EOAs), using _mint() bypasses a critical safety check:

  • _mint() does not verify whether the receiving address is capable of handling ERC721 tokens.

  • If the to address is a smart contract that does not implement onERC721Received, the token will be transferred but become permanently stuck inside that contract.
    This is a known pitfall in ERC721 usage and could lead to accidental loss of NFTs if, in the future, the game logic evolves or tokens are minted to escrow contracts, reward pools, staking contracts, or even mistakenly to the vault.

Impact:

  • NFTs can become permanently locked in contracts that do not support ERC721.

  • No way for users or contracts to recover these tokens unless the receiver explicitly adds rescue logic.

  • Reduces the safety and robustness of the NFT minting process.

Tools Used

Manual Review, Foundry

Recommended Mitigation:

Replace _mint() with _safeMint() in the mintEgg function:

function mintEgg(address to, uint256 tokenId) external returns (bool) {
require(msg.sender == gameContract, "Unauthorized minter");
- _mint(to, tokenId);
+ _safeMinter(to, tokenId);
totalSupply += 1;
return true;
}
Updates

Lead Judging Commences

m3dython Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Unsafe ERC721 Minting

Protocol doesn't check if recipient contracts can handle ERC721 tokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.