Closed sherlock-admin3 closed 4 months ago
This is expected, the EDITION_MANAGER_ROLE
holder (TitlesCore) will be upgraded at a later point to leverage this functionality for a planned feature. In any case, it's not a vulnerability.
I agree that this should be duplicated with #148
@WangSecurity pls confirm if this has been added as a dupe of #148
the other dupes have the 'medium' tag but this one doesn't yet
juan
high
Roles within any
Edition
contract can never be granted/revokedSummary
Edition.grantRoles
andEdition.revokeRoles
are uncallable by the owner of an Edition, leading to lost protocol functionality.The protocol intends the following functionality for the
EDITION_MANAGER_ROLE
:However 2/4 of these functionalities (3 and 4) will not be possible due to the bug.
Vulnerability Detail
When each
Edition
contract is initialised by theTitlesCore
contract, theTitlesContract
is given theEDITION_MANAGER_ROLE
. This is shown here:Hence, the following two functions can only be called by the
TitlesCore
contract. However, theTitlesCore
contract does not have any logic that can callEdition.grantRoles
orEdition.revokeRoles
.As a result, these functions are uncallable. This means that the owner of an edition will not be able to grant roles such as the
EDITION_MINTER_ROLE
to anybody. This means that only the owner will be allowed to callpromoMint()
, while the project intends for the owner to be able to allow others to callpromoMint
via theEDITION_MINTER_ROLE
as stated here:Also, they won't be able to grant
EDITION_MANAGER_ROLE
to anybody else, which renders thesetRoyaltyTarget()
function useless after initialisation since it also has theonlyRoles(EDITION_MANAGER_ROLE)
modifier.In total: the functionality of
grantRole()
,revokeRole()
,setRoyaltyTarget()
are completely blocked due to this logical bug.Impact
Edition owners will not be able to grant or revoke roles on an edition. As a result, a large amount of core protocol functionality is lost- user is never being able to grant various important roles to anybody.
Code Snippet
https://github.com/sherlock-audit/2024-04-titles/blob/c9d16782a7d3c15c7a759f22c9e0552d5e777ed7/wallflower-contract-v2/src/editions/Edition.sol#L423-L440
Tool used
Manual Review
Recommendation
Change the modifier to
onlyRolesOrOwner
rather thanonlyRoles
.Duplicate of #148