Using LensBaseERC721::_safeTransfer may lead to tokens being locked forever

Lines of code Vulnerability details Impact As we are all aware of, the OZ Address.sol function isContract can be bypassed because as the docs says: It is unsafe to assume that an address for which this function returns false is an externally-owned account EOA and not a contract. Among others,...

RewardDistributor._claim() Will Always Revert if The Recipient is a Contract

Lines of code Vulnerability details Impact The claim function is called to claim a reward for a given rewardIdentifier. The leaf node is calculated using the hashed index, account and amount values and is verified to belong to the merkle tree. After setting the reward as claimed, the tokens are...