Skip to content
Request an audit

‹ All findings

mintGenesis() mints with a push pattern using _mint() which may lead to lost tokens

MediumMetaZero Omnichain NFTs·Three Sigma · Omnichain RWA tokenisation · 27th January, 20243S-MetaZero-M01

ReportSource

Description

_mint() in mintGenesis() may send tokens to an address that can't deal with ERC721. _safeMint() would be recommended; however, it would introduce additional issues, namely reentrancy and possible malicious reverts.

Recommendation

Use a merkle tree to allow users to claim their genesis NFTs. This way, each user is responsible for claiming their NFT correctly. Additionally, it would be much cheaper for the owner of the MetaZeroVortex contract and the isGenesis mapping could be verified against the merkle tree, saving up to 1000 storage writes.

Status

Acknowledged