opensea-erc1155
opensea-erc1155 copied to clipboard
Reentrancy in mint()
https://github.com/ProjectOpenSea/opensea-erc1155/blob/59d2e0cd3b118d8aeb0ac27c4b0726feff3853c0/contracts/MyFactory.sol#L94
Calling mint(uint256 _optionId, address _toAddress, uint256 _amount, bytes calldata _data)
calls the internal
_mint(
Option _option,
address _toAddress,
uint256 _amount,
bytes memory _data
)
Which ends up running
if (id == 0) {
id = nftContract.create(_toAddress, _amount, "", _data);
optionToTokenID[optionId] = id;
} else {
nftContract.mint(_toAddress, id, _amount, _data);
}
If the nftContract itself supports callback hooks (like MyCollectible.sol), there is a reentrancy which could allow create
to be called twice with the same optionId