Use of transferFrom() rather than safeTransferFrom() for NFTs in will lead to the loss of NFTs

Lines of code 230, 342, 514, 536 Vulnerability details The EIP-721 standard says the following about transferFrom: /// @notice Transfer ownership of an NFT -- THE CALLER IS RESPONSIBLE /// TO CONFIRM THAT to IS CAPABLE OF RECEIVING NFTS OR ELSE /// THEY MAY BE PERMANENTLY LOST /// @dev Throws...

Use of resignOwnership can lead to stuck NFT in contract

Lines of code Vulnerability details Impact Contract OwnableUpgradeable has a resignOwnership function that, if called, can potentially cause the loss of the NFT after a draw has been started. Proof of Concept These are the steps/conditions that make this issue happen: When the owner calls...

Attacker can DOS private party by donating ETH then calling buy

Lines of code Vulnerability details Impact Party is DOS'd and may potentially lose access to NFT Proof of Concept Crowdfund.solL280-L298 party = party = partyFactory .createParty addressthis, Party.PartyOptions name: name, symbol: symbol, governance: PartyGovernance.GovernanceOpts hosts:...

ERC721 support not checked - NFT loss

Lines of code Vulnerability details Impact It is not checked whether withdrawn token supports ERC721 interface. Also there is no check to see if necessary approval have been set for sending nft The fix need to be applied for all other functions withdrawing ERC721 Proof of Concept 1. Observe the...