Closed code423n4 closed 2 years ago
Invalid.
Royalties are paid out to the address returned by getTokenCreatorPaymentAddress
. For the NFTDropCollection, that will return the owner
if a different paymentAddress
was not provided.
So we are effectively accomplishing what was suggested here, but without requiring an additional storage slot be populated when the data is redundant -- saving some gas when the collection is created.
Agreed. Same result, different implementation whereby the current one is more gas efficient.
Lines of code
https://github.com/code-423n4/2022-08-foundation/blob/main/contracts/NFTCollectionFactory.sol#L342
Vulnerability details
Impact
createNFTDropCollectionWithPaymentAddress()
doesn't ensure to receive royalties and mint payments to theaddress payable paymentAddress
Proof of Concept
The documentation side
Create a new drop collection contract with a custom payment address
and increateNFTDropCollectionWithPaymentAddress()
in the line342
where setting the value to thepaymentAddress
in the case(paymentAddress != msg.sender) == false
thepaymentAddress
will set topayable(0)
So the creator will not be able to receive royalties and mint paymentsRecommended Mitigation Steps
Change this line
paymentAddress != msg.sender ? paymentAddress : payable(0)
to this onepaymentAddress != msg.sender ? paymentAddress : msg.sender