Hertz City security record

The function `devMint` receives payment from `msg.sender` and mint NFT tokens to the account, the code on line 108 should use `require(msg.value>=DEV_MINT_PRICE*quantity)` instead of `require(msg.value>=DEV_MINT_LIMIT*quantity)` for the payment check.

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. ### External call(s) ```solidity=728 if (!_checkContractOnERC721Received(address(0), to, updatedIndex++, _data)) { ``` * This function call executes the following external call(s). * In `ERC721A._checkContractOnERC721Received`, * `ERC721A__IERC721Receiver(to).onERC721Received(_msgSenderERC721A(),from,tokenId,_data)` ### State variables written after the call(s) ```solidity=739 _currentIndex = updatedIndex; ``` --- ### External call(s) ```solidity=113 _safeMint(msg.sender,quantity); ``` * This function call executes the following external call(s). * In `ERC721A._checkContractOnERC721Received`, * `ERC721A__IERC721Receiver(to).onERC721Received(_msgSenderERC721A(),from,tokenId,_data)` ### State variables written after the call(s) ```solidity=115 devMinted[msg.sender]=devMinted[msg.sender]+quantity; ``` ```solidity=114 devMintedTotal+=quantity; ``` --- ### External call(s) ```solidity=127 _safeMint(msg.sender,quantity); ``` * This function call executes the following external call(s). * In `ERC721A._checkContractOnERC721Received`, * `ERC721A__IERC721Receiver(to).onERC721Received(_msgSenderERC721A(),from,tokenId,_data)` ### State variables written after the call(s) ```solidity=129 whitelistMinted[msg.sender]=whitelistMinted[msg.sender]+quantity; ``` ```solidity=128 whitelistMintedTotal+=quantity; ```

The functions which are never called internally within the contract should have external visibility for gas optimization. --- ```solidity=53 function setTreasuryWallet(address _wallet) public onlyOwner{ ``` --- ```solidity=58 function isPublicSaleActive() public view returns (bool){ ``` --- ```solidity=62 function isWhitelistSaleActive() public view returns (bool){ ``` --- ```solidity=66 function isDevMintActive() public view returns (bool){ ``` --- ```solidity=70 function setPublicSaleActive(bool newStatus) public onlyOwner{ ``` --- ```solidity=74 function setWhitelistSaleActive(bool newStatus) public onlyOwner{ ``` --- ```solidity=78 function setDevMintActive(bool newStatus) public onlyOwner{ ``` --- ```solidity=82 function addToWhitelist(address[] memory addresses) public onlyOwner { ``` --- ```solidity=88 function addToDevMint(address[] memory addresses) public onlyOwner { ``` --- ```solidity=94 function publicMint(uint256 quantity) public payable{ ``` --- ```solidity=104 function devMint(uint256 quantity) public payable{ ``` --- ```solidity=118 function whitelistMint(uint256 quantity) public payable{ ``` --- ```solidity=132 function withdraw() public { ``` --- ```solidity=136 function setBaseURI(string memory _base) public onlyOwner{ ```

After [EIP-1884](https://eips.ethereum.org/EIPS/eip-1884) was included in the Istanbul hard fork, it is not recommended to use `.transfer()` or `.send()` for transferring ether as these functions have a hard-coded value for gas costs making them obsolete as they are forwarding a fixed amount of gas, specifically `2300`. This can cause issues in case the linked statements are meant to be able to transfer funds to other contracts instead of EOAs.