Weather Witness
First Flight #40
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

Unsafe ERC721 token minting in function `WeatherNft::fulfillMintRequest()`

vladich0x

Root + Impact

Unsafe ERC721 token minting in function WeatherNft::fulfillMintRequest() could lead to a token loss

Description

The WeatherNft contract is minting ERC721 tokens in an unsafe manner. The contract uses the _mint() function, which does not check whether the to address is capable of handling ERC721 tokens. In case to is a smart contract, not implementing onERC721Received, the NFT will be locked permanently in the contract.

function fulfillMintRequest(bytes32 requestId) external {
// ...
emit WeatherNFTMinted(
requestId,
msg.sender,
Weather(weather)
);
@> _mint(msg.sender, tokenId); // unsafe minting
s_tokenIdToWeather[tokenId] = Weather(weather);

Risk

Likelihood: Medium

Impact:

  • Token loss: minted NFT could be send to a smart contract, not handling properly ERC721 tokens and lead to a permanent token loss

Proof of Concept

Recommended Mitigation

Use _safeMint() instead of _mint() in function WeatherNft::fulfillMintRequest()

function fulfillMintRequest(bytes32 requestId) external {
// ...
emit WeatherNFTMinted(
requestId,
msg.sender,
Weather(weather)
);
- _mint(msg.sender, tokenId);
+ _safeMint(msg.sender, tokenId);
s_tokenIdToWeather[tokenId] = Weather(weather);
// ...

This ensures that smart contracts receiving NFTs can handle them, preventing token loss.

Updates

Appeal created

bube Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[Invalid] Use of `_mint` istead of `_safeMint`

The `fulfillMintRequest` function is external and anyone can call it. If the protocol uses `_safeMint` instead of `_mint`, this introduces a reentrancy risk. It is better to use `_mint` and the caller is responsible for being able to obtain the token.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.