Weather Witness
First Flight #40
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

Unsafe use of `_mint` instead of `_safeMint`

jeetpal2007

Description

Unsafe use of _mint instead of _safeMint in /src/WeatherNft.sol

_mint(msg.sender, tokenId);
s_tokenIdToWeather[tokenId] = Weather(weather);

Vulnerability Details

The usage of _safeMintguarantees that the receiver toaddress is either a smart contract that implements IERC721Receiver.onERC721Receivedor an EOA.

Impact

Using _mint instead of _safeMint can cause NFTs to be lost if sent to a smart contract that doesn't support receiving ERC721 tokens. _mint skips safety checks, which may result in tokens being locked or inaccessible. This can lead to user asset loss and reduces the reliability of the contract.

Tools Used

Manual analyzed

Recommendations

According to OpenZeppelin usage of _mintis discouraged,use _safeMintwhenever possible.

See the docs: https://docs.openzeppelin.com/contracts/4.x/api/token/erc721#ERC721-_safeMint-address -uint256-

Updates

Appeal created

bube Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[Invalid] Use of `_mint` istead of `_safeMint`

The `fulfillMintRequest` function is external and anyone can call it. If the protocol uses `_safeMint` instead of `_mint`, this introduces a reentrancy risk. It is better to use `_mint` and the caller is responsible for being able to obtain the token.

jeetpal2007 Submitter
4 months ago
bube Lead Judge
4 months ago
bube Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[Invalid] Use of `_mint` istead of `_safeMint`

The `fulfillMintRequest` function is external and anyone can call it. If the protocol uses `_safeMint` instead of `_mint`, this introduces a reentrancy risk. It is better to use `_mint` and the caller is responsible for being able to obtain the token.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.