search

sherlock-audit / 2024-04-titles-judging

9 stars 6 forks source link

AgileJune - A new work publisher might lose the left ETH since of no refund functionality, which will be locked in FeeManger. #233

Closed sherlock-admin4 closed 4 months ago

sherlock-admin4 commented 4 months ago

AgileJune

medium

A new work publisher might lose the left ETH since of no refund functionality, which will be locked in FeeManger.

Summary

A new work publisher might lose unexpected ETH because there is not refunding for left ETHs.

Vulnerability Detail

The work publisher calls TitlesCore.sol::publish() which in turn calls _publish() -> feeManager.collectCreationFee(). This function will collect protocolCreationFee which is defined in FeeMananger. The fee can be changed by owner's calling of setter function (setProtocolFees()). If the fee has been changed(decreased) by owner while publish transaction is pending, the left funds are remained in FeeManager contract and locked

Impact

The work publisher's funds are locked in contract

Code Snippet

https://github.com/sherlock-audit/2024-04-titles/blob/main/wallflower-contract-v2/src/TitlesCore.sol#L120-L149 https://github.com/sherlock-audit/2024-04-titles/blob/main/wallflower-contract-v2/src/fees/FeeManager.sol#L166-L175

Tool used

Manual Review

Recommendation

Recommend to refund the left balance functionality in FeeManage::collectCreationFee() (FeeManager -> TitlesCore), and TitlesCore::publish() (TtilesCore -> msg.sender).