mintBatch mints more tokens than the amount on which the fees was applied.

Summary

Fees is applied on the amount of tokens a user requests to mint but there is Discrepancy between the tokens on which the fees was applied and total tokens that are minted.

Vulnerability Detail

Following is mintBatch function

function mintBatch(
        address[] calldata receivers_,
        uint256 tokenId_,
        uint256 amount_,
        bytes calldata data_
    ) external payable {
        // wake-disable-next-line reentrancy
        FEE_MANAGER.collectMintFee{value: msg.value}(
            this, tokenId_, amount_, msg.sender, address(0), works[tokenId_].strategy
        );

        for (uint256 i = 0; i < receivers_.length; i++) {
            _issue(receivers_[i], tokenId_, amount_, data_);
        }

        _refundExcess();
    }

From above it is clear that fee is applied only on amount number of tokens. But when the for loop is executed it issues each receiver tokens = amount number of tokens essentially total tokens minted are = number of receivers*amount whereas the fees was only collected for amount number of tokens thus allowing minting of excess tokens without paying any fee.

Impact

A user can mint tokens by paying only very less fee than they should because number of receivers can be any number(even same user as every array element).

Code Snippet

https://github.com/sherlock-audit/2024-04-titles/blob/d7f60952df22da00b772db5d3a8272a988546089/wallflower-contract-v2/src/editions/Edition.sol#L316

Tool used

Manual Review

Recommendation

make the following change in the code

--- for (uint256 i = 0; i < receivers_.length; i++) {
            _issue(receivers_[i], tokenId_, amount_, data_);
        }
+++  for (uint256 i = 0; i < receivers_.length; i++) {
            _issue(receivers_[i], tokenId_, amount_/(receivers_.length) , data_);
        }

Duplicate of #264