Protocol doesn't validate that user pays fees in ETH, causing that users can mint without paying fees, or paying little amount of fees.
Vulnerability Detail
Amount sent by users is not validated against the amount required to be sent which can lead to users sending little or no eth as fees while minting. This will lead to loss of funds as protocol will not get needed fees for minting.
When users mint, they're sometimes required to pay fees, for minting. The ETH sent as fees is collected through the collectMintFee function.
ZanyBonzy
medium
Protocol doesn't validate that users send fees
Summary
Protocol doesn't validate that user pays fees in ETH, causing that users can mint without paying fees, or paying little amount of fees.
Vulnerability Detail
Amount sent by users is not validated against the amount required to be sent which can lead to users sending little or no eth as fees while minting. This will lead to loss of funds as protocol will not get needed fees for minting. When users mint, they're sometimes required to pay fees, for minting. The
ETH
sent as fees is collected through thecollectMintFee
function.The
_collectMintFee
function collects and splits the fees in its required shares. Notice that no validation is made that msg.value sent == fee.amountThe fees get routed and transferred to the required addresses.
A malicious user can simply mint editions without sending any ETH or sending very little, less than he's supposed to send.
Impact
Loss of funds for protocol due to free minting.
Code Snippet
https://github.com/sherlock-audit/2024-04-titles/blob/d7f60952df22da00b772db5d3a8272a988546089/wallflower-contract-v2/src/fees/FeeManager.sol#L366 https://github.com/sherlock-audit/2024-04-titles/blob/d7f60952df22da00b772db5d3a8272a988546089/wallflower-contract-v2/src/editions/Edition.sol#L236
Tool used
Manual Code Review
Recommendation
Validate that msg.value sent is equal to the fee.amount