GPT-5 finding
parseTokenId may select the wrong NFT if another ERC721 mint occurs in the same tx
mediummaintainabilityhigh
- scripts/reposition.ts:161-173
The selector matches any ERC721 Transfer(from=0x0, to=..., tokenId), without verifying the emitting contract address is NFPM. If a router/aggregator or another protocol also mints an NFT in the same transaction, this may capture the wrong tokenId and write an incorrect record.
Recommendation
Filter by the emitting contract address (ADDRESSES.NFPM_V3). Update parseTokenId to accept full receipt logs with the address field and require log.address.toLowerCase() === ADDRESSES.NFPM_V3.toLowerCase(). Alternatively, decode the return data from the mint call if available.