Collection Owners Can Reinitialize `CoreCollection.sol` and Mint Duplicate NFTs

[code423n4]

Lines of code

https://github.com/code-423n4/2022-03-joyn/blob/main/core-contracts/contracts/CoreCollection.sol#L78-L97

Vulnerability details

Impact

The initialize() function is called by CoreFactory.sol when creating projects or adding collections to an existing project. When ownership of the CoreCollection.sol contract is transferred to the project owner, it gives the owner access to a subset of functions, including the initialize() function.

This function does not implement proper access control to prevent reinitialization. As such, an owner could rug its own collection by reinitializing with a mint fee of zero and a different maxSupply, allowing them to potentially a duplicate NFT as the tokenId is calculated by the following equation:

• tokenId = ((startingIndex + totalSupply()) % maxSupply) + 1

Recommended Mitigation Steps

Prevent collection owners from reinitializing the CoreCollection.sol contract by making use of OpenZeppelin's Initializable.sol contract.

[sofianeOuafir]

In my opinion, the severity level should be 3 (High Risk) instead of 2 (Med Risk)

duplicate of #4