sherlock-audit / 2024-04-titles-judging

6 stars 6 forks source link

ZdravkoHr. - `Edition` does not have way to set default royalties #298

Closed sherlock-admin3 closed 2 months ago

sherlock-admin3 commented 3 months ago

ZdravkoHr.

medium

Edition does not have way to set default royalties

Summary

Edition.sol does not have public/external functions for setting and removing default royalties.

Vulnerability Detail

ERC2981.sol has functions for setting and removing default royalties. These functions are internal and the inheriting contract should implement a public/external functions that call them. This is not the case, as Edition.sol does not have such functions.

Impact

It's impossible to set the default royalty of the Edition contract.

Code Snippet

    function _setDefaultRoyalty(address receiver, uint96 feeNumerator) internal virtual {
        uint256 feeDenominator = _feeDenominator();
        /// @solidity memory-safe-assembly
        assembly {
            feeNumerator := shr(160, shl(160, feeNumerator))
            if gt(feeNumerator, feeDenominator) {
                mstore(0x00, 0x350a88b3) // `RoyaltyOverflow()`.
                revert(0x1c, 0x04)
            }
            let packed := shl(96, receiver)
            if iszero(packed) {
                mstore(0x00, 0xb4457eaa) // `RoyaltyReceiverIsZeroAddress()`.
                revert(0x1c, 0x04)
            }
            sstore(_ERC2981_MASTER_SLOT_SEED, or(packed, feeNumerator))
        }
    }

    /// @dev Sets the default royalty `receiver` and `feeNumerator` to zero.
    function _deleteDefaultRoyalty() internal virtual {
        /// @solidity memory-safe-assembly
        assembly {
            sstore(_ERC2981_MASTER_SLOT_SEED, 0)
        }
    }

Tool used

Manual Review

Recommendation

Add public/external functions to set and remove default royalties.