Closed sherlock-admin3 closed 4 months ago
Escalate
Duplicate of #264
Escalate
Duplicate of #264
You've created a valid escalation!
To remove the escalation from consideration: Delete your comment.
You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final.
Agree with the escalation, planning to accept and duplicate with #264
Result: High Duplicate of #264
AgileJune
high
The user using Edition.sol::mintBatch(one token to multiple receivers) will avoid to pay expected mint Fee.
Summary
Edition.sol::mintBatch(one token to multiple receivers) is paying fee for only param
amount_
, but total minted amount isreceivers_.length * amount_
Vulnerability Detail
If user mints the token's amount with
mint()
function, collected fee would bereceivers_.length * amount_ * (strategy_.mintFee + protocolFlatFee)
, but with the mintBatch function, collected fee is onlyamount_ * (strategy_.mintFee + protocolFlatFee)
.Impact
As a result, the protocol will get and distribute less than expected fee amounts.
Code Snippet
https://github.com/sherlock-audit/2024-04-titles/blob/main/wallflower-contract-v2/src/editions/Edition.sol#L311-L312
Tool used
Manual Review
Recommendation
The function needs to pass
receivers_.length * amount_
in FEEMANAGER.collectMintFee() function instead of `amount`.Duplicate of #264