The GovNFT:safeTransferMany function its not performing a _safeTransfer

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-tigris/blob/main/contracts/GovNFT.sol#L245-L249

Vulnerability details

Impact

The function safeTransferMany its not doing a _safeTransfer its just using _transfer

Use of _transfer method for ERC721 is discouraged and recommended to use _safeTransfer
whenever possible by OpenZeppelin.

This is because _transfer cannot check whether the receiving address know how to handle ERC721 tokens. If the recipient is a contract not aware of incoming NFTs, then the transferred NFT would be locked in the recipient forever.

The name of the function is safeTransferMany thats why its expected to do a _safeTransfer

Proof of Concept

Use safeTransferMany to transfer NFT to a contract and you will see that its no triggerin the expected callback hook on the receiver contract.

Tools Used

Manual revision

Recommended Mitigation Steps

Use _safeTransfer instead of _transfer, take in consideration that _safeTransfer will trigger a callback to the receiver, so stick to check - effects - itterarion pattern

Also you havent implemented a _safeTransfer as you do on _transfer GovNFT.sol#L94-L101

[c4-judge]

GalloDaSballo marked the issue as duplicate of #356

[c4-judge]

GalloDaSballo marked the issue as satisfactory