Closed sherlock-admin4 closed 4 months ago
Escalate
Requesting another review of this report. It can be argued that this report is a duplicate of #267 - Same root cause and impact.
The escalation could not be created because you are not exceeding the escalation threshold.
You can view the required number of additional valid issues/judging contest payouts in your Profile page, in the Sherlock webapp.
Escalate
Requesting another review of this report. It can be argued that this report is a duplicate of #267 - Same root cause and impact.
Escalate
Requesting another review of this report. It can be argued that this report is a duplicate of #267 - Same root cause and impact.
You've created a valid escalation!
To remove the escalation from consideration: Delete your comment.
You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final.
Agree with the escalation, planning to accept and duplicate with #267
Result: High Duplicate of #267
brakeless
medium
Collection referrers do not receive their allocation of the protocolShare
Summary
When the
protocolShare
is split inFeeManager::_splitProtocolFees()
, thecollectionReferrerShare
is mistakenly sent to the mintreferrer_
.Vulnerability Detail
The
collectionReferrerShare
is checked againstreferrers[edition_]
, but at the end of the function the fee is routed toreferrer_
.The
referrer_
, which represents the mint referrer, receives two payments - bothmintReferrerShare
andcollectionReferrerShare
.Add this test to
FeeManager.t.sol
.Run with the following command:
forge test --match-test test_collectMintFeeWithCollectionReferrer -vvvv
As shown in the output, the mint referrer collects all the referrer fees and the collection referrer receives nothing.
Impact
Loss of fees for collection referrers
Code Snippet
https://github.com/sherlock-audit/2024-04-titles/blob/main/wallflower-contract-v2/src/fees/FeeManager.sol#L412-L441
Tool used
Manual Review
Recommendation
Change the target destination to
referrers[edition_]
for thecollectionReferrerShare
route.Duplicate of #267