_safeMint() should be used rather than _mint() wherever possible

Lines of code 139, 178, 204 Vulnerability details mint is discouraged in favor of safeMint which ensures that the recipient is either an EOA or implements IERC721Receiver. Both OpenZeppelin and solmate have versions of this function. In the cases below, mint does not call...

_safeMint() should be used rather than _mint() wherever possible

Lines of code 139, 178, 204 Vulnerability details mint is discouraged in favor of safeMint which ensures that the recipient is either an EOA or implements IERC721Receiver. Both OpenZeppelin and solmate have versions of this function. In the cases below, mint does not call...

_safeMint() should be used rather than _mint() wherever possible

Lines of code 139, 178, 204 Vulnerability details Impact mint is discouraged in favor of safeMint which ensures that the recipient is either an EOA or implements IERC721Receiver. Both OpenZeppelin and solmate have versions of this function. In the cases below, mint does not call...

Multiple instances of reentrancy

Lines of code Vulnerability details Impact This can lead to massive loss of funds and asset in Nextgen. Proof of Concept There are multiple instances of reentrancy in NextGenCore.sol, MinterContract.sol and AuctionMemo.sol. These reentrancy is due to the use of ERC721 safeMint... for token transf...

Lack of nonReentrant modifier when using _safeMint function

Lines of code Vulnerability details Impact The safeMint function implementation can allow a contract to reenter the the calling contract. Proof of Concept the safeMint function can be reentered through the safeMint function. function safeMintaddress to, UserMetadata calldata userMetadata public...

Enormous tokens can be minted by malicious user via reentrancy

Lines of code Vulnerability details Impact The function safeMInt that is used to mint new tokens, makes an external call to ERC721.sol's safeMint which contains a callback to the "to" address argument. checkOnERC721Receivedaddress0, to, tokenId, data safeMint lacks a reentrancy guard, a malicious...

TOKEN CAN BE LOCKED WHEN THE _mint function is called to mint token to a contract that does not support the ERC1155

Lines of code Vulnerability details Impact Use safeMint intead of mint. The mint function of the TimeswapV2Token.solL110 calls the mint function of the ERC1155. If the token receiver is a contract that does not support ERC1155, the token is locked. Proof of Concept see: If the recipient contract...

Need to check the _mint() status before increment the token count .

Lines of code Vulnerability details Impact Its possible to increase the tokenIdTracker even mint function failed. The mint status must be checked before increment tokenIdTracker value . Proof of Concept function registeraddress recipient public onlyUnregistered returns uint256 tokenId address...

Attacker can frontrun and reenter this function causing users to get griefed

Lines of code Vulnerability details Impact 1. attacker calls createFor and there is reentracy in safemint and an attacker can reenter and just keep increasing count just a side note 2. but what an attacker can do is when a user wants to call this function or launch a project an attacker frontruns...

mintBorrowTicketTo can be a contract with no onERC721Received method, which may cause the BorrowTicket NFT to be frozen and put users' funds at risk

Lines of code Vulnerability details IERC721MintableborrowTicketContract.mintmintBorrowTicketTo, id; function mintaddress to, uint256 tokenId external override loanFacilitatorOnly mintto, tokenId; If mintBorrowTicketTo is a contract that does not implement the onERC721Received method, in the curre...

Depositor can reenter contract on claim creation

Handle kenzo Vulnerability details This finding is almost identical to my previous finding "Claimer can reenter contract on claim creation", but in this scenario, the depositor can reenter via Depositors' safeMint function. When depositing, Depositors is minting the token using safeMint, which wi...

Rewards can be stolen by re-entering into updateDistribution

Handle cmichel Vulnerability details The XDEFIDistribution.updateDistribution function does not have re-entrancy locks and can be called from lock - lock - safeMint which gives control back to the msg.sender if it is a contract by performing msg.sender.onERC721Received.... As the...

Missing noreentrant modifier on merge() and updateDistribution(), can reenter from the _lock()

Handle Fitraldys Vulnerability details Impact A user can call lock that will call lock, that eventually will call safeMint, the safeMint function will make an external call to the destination address through checkOnERC721Received, and since the merge and updateDistribution didnt have noreentrant...

DOS - preventing users from locking assets

Handle egjlmn1 Vulnerability details An attacker can prevent any user from locking assets due to the unsafe id generation for the nfts. The id is generated by using only the amount deposited, the duration to lock and the totalSiupply of nfts. The first two are easy for the attacker to copy, so al...

The reentrancy vulnerability in _safeMint can allow an attacker to steal all rewards

Handle cccz Vulnerability details Impact There is a reentrancy vulnerability in the safeMint function function safeMint address to, uint256 tokenId, bytes memory data internal virtual mintto, tokenId; require checkOnERC721Receivedaddress0, to, tokenId, data, "ERC721: transfer to non ERC721Receive...

Reentrancy at lock can lead to wrong accounting

Handle kenzo Vulnerability details The lock function calls safeMint in the midst of it. This can lead to reentry to updateDistribution, thereby ruining contract invariants. Impact At worst case, loss of user funds: distributableXDEFI will be set to be bigger than it really is, and so when a...