# mintGenesis() mints with a push pattern using _mint() which may lead to lost tokens Medium · Three Sigma · Omnichain RWA tokenisation · 27th January, 2024 Finding 3S-MetaZero-M01 of the MetaZero Omnichain NFTs security review. - Protocol: https://metazero.gg/ - Report: /reports/metazero-i - Source: https://cdn.sanity.io/files/qoqld077/production/1b1ab4ff365756fe1d86767f1e06744407570f5a.pdf --- ### Description [_mint()](https://github.com/threesigmaxyz/metazero-issues-external/blob/master/src/ONFTV2-721C.sol#L60) in [mintGenesis()](https://github.com/threesigmaxyz/metazero-issues-external/blob/master/src/ONFTV2-721C.sol#L67) may send tokens to an address that can't deal with ERC721. _safeMint() would be recommended; however, it would introduce additional issues, namely reentrancy and possible malicious reverts. ### Recommendation Use a merkle tree to allow users to claim their genesis NFTs. This way, each user is responsible for claiming their NFT correctly. Additionally, it would be much cheaper for the owner of the MetaZeroVortex contract and the isGenesis mapping could be verified against the merkle tree, saving up to 1000 storage writes. ### Status Acknowledged --- Related findings: - [Checks-effects-interations pattern is not always followed, which can be used to drain all tokens](https://0xsimao.com/findings/singularity-effects-interations-followed-drain): Singularity - [Reusing the same rho and pubKey in different deposits leads to lost tokens](https://0xsimao.com/findings/singularity-reusing-rho-pub-deposits): Singularity - [Lost rewards when the supply is `0`, which always happens if the rewards are queued before anyone has `StakeTracker` tokens](https://0xsimao.com/findings/tokemak-rewards-happens-stake-tracker): Tokemak