Use safeTransferFrom instead of transferFrom for IERC721 transfers

[code423n4]

Lines of code

https://github.com/code-423n4/2022-11-looksrare/blob/main/contracts/lowLevelCallers/LowLevelERC20Transfer.sol#L24

Vulnerability details

Impact

The transferFrom() method is used instead of safeTransferFrom(), presumably to save gas. I however argue that this isn’t recommended because:

OpenZeppelin’s documentation discourages the use of transferFrom(), use safeTransferFrom() whenever possible
Given that any NFT can be used for the call option, there are a few NFTs that have logic in the onERC721Received() function, which is only triggered in the safeTransferFrom() function and not in transferFrom()

Proof of Concept

code-423n4/2022-05-cally-findings#38 (comment)

Tools Used

Manual

Recommended Mitigation Steps

Call the safeTransferFrom() method instead of transferFrom() for NFT transfers. Note that the looksrare contract should inherit the ERC721TokenReceiver contract as a consequence.

[c4-judge]

Picodes marked the issue as unsatisfactory:
Invalid