Submitted by hickuphh3, also found by 0xDjango, kirk-baird, leastwood, m9800, minhquanym, and pedroais
The transferFrom() function returns a boolean value indicating success. This parameter needs to be checked to see if the transfer has been successful. Oddly, transfer() function calls were checked.
Some tokens like EURS and BAT will not revert if the transfer failed but return false instead. Tokens that dont actually perform the transfer and return false are still counted as a correct transfer.
Users would be able to mint NFTs for free regardless of mint fee if tokens that dont revert on failed transfers were used.
Check the success boolean of all transferFrom() calls. Alternatively, use OZs SafeERC20s safeTransferFrom() function.
sofianeOuafir (Joyn) confirmed, disagreed with severity and commented:
deluca-mike (judge) increased severity to High and commented:
