Weather Witness
First Flight #40
Beginner FriendlyFoundrySolidityNFT
100 EXP
View all submissions
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

[L-2] Missing Use Of _Safemint in ```WeatherNft::fulfillMintRequest``` Function.

Author Revealed upon completion

Root + Impact

[L-2] Missing Use Of _Safemint in WeatherNft::fulfillMintRequest Function.

Description

The WeatherNft Contract uses _mint Function To mint NFTS.However,
_safemint should be used instead of just _mint function,to ensure
more security.Without _safemint nfts can get locked permanently in contract
which does not support receiving Them.

Impact:

1.NFTS can get locked in contract permanently,if there is no receiving support.

2.NON-Compliance with ERC721 Standards.

Proof of Concept

Attacker deploys attack contract which does not implement IERC721Receiver interface ,
and calls the mint function using attack contract as the msg.sender.

Recommended Mitigation

Use _safemint instead of _mint:

- _mint(msg.sender, tokenId);
+ _safeMint(msg.sender,tokenId);
​
Updates

Appeal created

bube Lead Judge 2 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[Invalid] Use of `_mint` istead of `_safeMint`

The `fulfillMintRequest` function is external and anyone can call it. If the protocol uses `_safeMint` instead of `_mint`, this introduces a reentrancy risk. It is better to use `_mint` and the caller is responsible for being able to obtain the token.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.