I have a smart contract that allows one to purchase a set number of NFTs for 0.2 ether each. I have set the owner of the smart contract to the one who deploys it and whenever someone purchases an item via my dapp, it should mint the token for them and then transfer the ethereum passed into the function to the owner. I also want to be able to change the _cap, only if I am the owner, as long as its below 500, so I can release the NFTs in waves.
address payable private _owner;
uint256 private _cap = 10;
constructor(string memory myBase) ERC721("Nftree", "Tree") {
_setBaseURI(myBase);
_owner = msg.sender;
}
function buyItem()
public
payable
returns (uint256)
{
require(totalSupply() < _cap);
require(msg.value == 0.2 ether, "Need to send exactly 0.2 ether");
_tokenIds.increment();
uint256 newItemId = _tokenIds.current();
_safeMint(msg.sender, newItemId);
_owner.transfer(msg.value);
return newItemId;
}
function setCap(uint256 newCap) public returns (uint256 changedCap){
require(_owner==msg.sender);
require(newCap<=500);
_cap = newCap;
return _cap;
}
I am wondering if it is dangerous to send msg.value directly to the owner via the transfer function, and if there are any security flaws anyone can see.
Additionally I am thinking of calling _owner.transfer before _safeMint, so that my dapp is updated with the number of tokens minted on cue, instead of updating slightly before the transaction has completed.Would this cause any issues?
Thank you