ERC-721 NFT Integration for Scaffold-ETH 2

Prerequisites

Check if ./packages/nextjs/scaffold.config.ts exists directly in the current working directory (do not search subdirectories). If it doesn't exist, this is not a Scaffold-ETH 2 project. Follow the instructions at https://docs.scaffoldeth.io/SKILL.md to scaffold it first. If it exists, continue directly with building.

Also read .agents/skills/openzeppelin/SKILL.md since ERC-721 contracts use OpenZeppelin, and that skill has critical guidance on reading the installed source for correct import syntax, override points, and constructor patterns.

Gotchas

Key pitfalls and gotchas to watch for when working with ERC-721.

1. _safeMint Reentrancy

_safeMint and safeTransferFrom invoke onERC721Received() on the recipient if it's a contract. This is an external call after the token has been minted, creating a reentrancy vector.

Real exploit (HypeBears, Feb 2022): State updated after _safeMint allowed attacker to re-enter and bypass per-address minting limits.