Use safeTransferFrom() instead of transferFrom() for outgoing erc721 transfers

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-forgeries/blob/main/src/VRFNFTRandomDraw.sol#L187
https://github.com/code-423n4/2022-12-forgeries/blob/main/src/VRFNFTRandomDraw.sol#L295
https://github.com/code-423n4/2022-12-forgeries/blob/main/src/VRFNFTRandomDraw.sol#L315

Vulnerability details

Impact

There is a potential loss of NFT where the recipient is a contract address and it is unable to handle the sent ERC721s.

Proof of Concept

The transferFrom() method is used instead of safeTransferFrom() isn’t recommended because:

• OpenZeppelin’s documentation (See https://docs.openzeppelin.com/contracts/4.x/api/token/erc721#IERC721-transferFrom-address-address-uint256-) discourages the use of transferFrom(); use safeTransferFrom() whenever possible
• The recipient could have logic in the onERC721Received() function, which is only triggered in the safeTransferFrom() function and not in transferFrom().

Tools Used

Manual

Recommended Mitigation Steps

Replace transferFrom with safeTransferFrom

[c4-judge]

Duplicate of #220

[gzeoneth]

Misclick, duplicate of #356