Edition::mintBatch(address[] calldata receivers_, ...) calculates incorrect fees for minters
Summary
Edition::mintBatch(address[] calldata receivers_, ...) allows minters to mint the same work (tokenId) to several receivers, but does not charge fees for the equivalent amount of tokens minted.
Vulnerability Detail
Edition::mintBatch(address[] calldata receivers_, ...) charges the mint fee only on the amount sent as argument, but an array of receivers will receive the tokens. This means that minters are able to mint tokens n times cheaper than expected. For example, if a minter wants to mint 10 tokens, it would pay amount * totalFees = 10 * totalFees. However, the minter is able to call Edition::mintBatch(address[] calldata receivers_, ...) with an amount of 1 and 10 receivers (its address) and pay 10 times less fees.
Impact
Fee manipulation and severe yield loss for everyone involved except the minter.
0x73696d616f
high
Edition::mintBatch(address[] calldata receivers_, ...)
calculates incorrect fees for mintersSummary
Edition::mintBatch(address[] calldata receivers_, ...)
allows minters to mint the samework
(tokenId
) to severalreceivers
, but does not charge fees for the equivalent amount of tokens minted.Vulnerability Detail
Edition::mintBatch(address[] calldata receivers_, ...)
charges the mint fee only on theamount
sent as argument, but an array ofreceivers
will receive the tokens. This means that minters are able to mint tokensn
times cheaper than expected. For example, if a minter wants to mint10
tokens, it would payamount * totalFees = 10 * totalFees
. However, the minter is able to callEdition::mintBatch(address[] calldata receivers_, ...)
with an amount of1
and10
receivers (its address) and pay10
times less fees.Impact
Fee manipulation and severe yield loss for everyone involved except the minter.
Code Snippet
Edition::mintBatch(address[] calldata receivers_, ...):
Tool used
Manual Review
Vscode
Recommendation
The fees charged should be
amount * receivers.length
.Duplicate of #264