Weather Witness
First Flight #40
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: medium
Invalid

Use of _mint() instead of _safeMint()

avalance

Description

The smart contract exposes a vulnerability by using the _mint function directly instead of the safeMint function in the WeatherNFT method. This issue can result in unsafe minting, potentially causing problems such as tokens being minted to invalid addresses or incompatible contracts.

function fulfillMintRequest(bytes32 requestId) external {
bytes memory response = s_funcReqIdToMintFunctionReqResponse[requestId].response;
bytes memory err = s_funcReqIdToMintFunctionReqResponse[requestId].err;
​
require(response.length > 0 || err.length > 0, WeatherNft__Unauthorized());
​
if (response.length == 0 || err.length > 0) {
return;
}
​
UserMintRequest memory _userMintRequest = s_funcReqIdToUserMintReq[
requestId
];
uint8 weather = abi.decode(response, (uint8));
uint256 tokenId = s_tokenCounter;
s_tokenCounter++;
​
emit WeatherNFTMinted(
requestId,
msg.sender,
Weather(weather)
);
_mint(msg.sender, tokenId); // >@audit using _mint
s_tokenIdToWeather[tokenId] = Weather(weather);
​

Risk

This does not check if the to address is a smart contract that supports receiving NFTs. If the recipient is a contract and does not implement onERC721Received(), the NFT will be permanently stuck.

The NFT can be locked in an unusable state if sent to an incompatible smart contract. This leads to loss of access for users and potential financial impact if the NFT holds value.

Recommended Mitigation

- _mint(msg.sender, tokenId);
+ safemint(msg.sender, tokenId);
Updates

Appeal created

bube Lead Judge 6 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[Invalid] Use of `_mint` istead of `_safeMint`

The `fulfillMintRequest` function is external and anyone can call it. If the protocol uses `_safeMint` instead of `_mint`, this introduces a reentrancy risk. It is better to use `_mint` and the caller is responsible for being able to obtain the token.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.