Creating an edition not through TitlesCore can avoid paying the creation fee.
Summary
If someone creates a new edition through TitlesCore, they have to create the first tokenId and pay the creation fee. However, they can create a new edition manually without making any tokenId to avoid paying the creation fee.
Vulnerability Detail
Here is a contract that allows creating new editions.
(Where titlesCore, feeManager and graph are those of the protocol.)
If Bob creates a new edition through this contract, there is no requirement to generate the first tokenId, so he can avoid paying the creation fee. Even the new edition created outside of TitlesCore.sol has no functional differences from those generated through TitlesCore.sol.
However, at L87 of TitlesCore::createEdition, the publication of the first tokenId necessitates the payment of the creation fee.
0x486776
high
Creating an edition not through
TitlesCore
can avoid paying the creation fee.Summary
If someone creates a new edition through
TitlesCore
, they have to create the firsttokenId
and pay the creation fee. However, they can create a new edition manually without making anytokenId
to avoid paying the creation fee.Vulnerability Detail
Here is a contract that allows creating new editions.
(Where
titlesCore
,feeManager
andgraph
are those of the protocol.)If Bob creates a new edition through this contract, there is no requirement to generate the first
tokenId
, so he can avoid paying the creation fee. Even the new edition created outside ofTitlesCore.sol
has no functional differences from those generated throughTitlesCore.sol
.However, at
L87
ofTitlesCore::createEdition
, the publication of the firsttokenId
necessitates the payment of the creation fee.Impact
Anyone can create a new edition without paying the creation fee.
Code Snippet
https://github.com/sherlock-audit/2024-04-titles/blob/main/wallflower-contract-v2/src/TitlesCore.sol#L72-L96
Tool used
Manual Review
Recommendation
In
TitlesCore.sol
, there should be a state variable that keeps track of all valid editions created throughTitlesCore.sol
.