ONFA - Audit

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. *This finding is considered minor because the state variable is only incremented or decremented. So, the effect of out-of-order increments may be unobservable after transaction. However, the reentrancy vulnerability may still cause other issues in the middle of transaction.* ### External call(s) ```solidity=1551 _safeMint(to, tokenId); ``` * This function call executes the following external call(s). * In `ERC721._checkOnERC721Received`, * `retval = IERC721Receiver(to).onERC721Received(_msgSender(),from,tokenId,_data)` ### State variables written after the call(s) ```solidity=1552 _setTokenURI(tokenId, uri); ``` * This function call executes the following assignment(s). * In `ERC721URIStorage._setTokenURI`, * `_tokenURIs[tokenId] = _tokenURI` --- ### External call(s) ```solidity=1575 _safeMint(to[i], tokenId[i]); ``` * This function call executes the following external call(s). * In `ERC721._checkOnERC721Received`, * `retval = IERC721Receiver(to).onERC721Received(_msgSender(),from,tokenId,_data)` ### State variables written after the call(s) ```solidity=1576 _setTokenURI(tokenId[i], uri[i]); ``` * This function call executes the following assignment(s). * In `ERC721URIStorage._setTokenURI`, * `_tokenURIs[tokenId] = _tokenURI`