Several functions in Edition.sol cannot be called

Summary

When an Edition.sol contract is created, it is initialized with an EDITION_MANAGER_ROLE equal to the TitlesCore.sol contract. The issue is that many functions can only be called by the EDITION_MANAGER_ROLE, but that would be impossible as TitlesCore.sol does not allow that.

Vulnerability Detail

The EDITION_MANAGER_ROLE is always equal to the TitlesCore.sol contract:

edition.initialize(
     feeManager, graph, payload.work.creator.target, address(this) --> the EDITION_MANAGER_ROLE, payload.metadata
);

Here are the functions that should allow to be called by the EDITION_MANAGER_ROLE address: publish, promoMint, setRoyaltyTarget, grantRoles, revokeRoles, grantPublisherRole, and revokePublisherRole. In order for all of these functions to be callable by the 'EDITION_MANAGER_ROLE', they must be called somewhere inside the TitlesCore.sol contract. This is true for only the publish and 'setRoyaltyTargetfunctions, as all other functions are never called inside of TitlesCore.sol. Therefore, no roles can ever be granted or revoked, and only the owner can callgrantPublisherRole, revokePublisherRole and promoMint, which should not be the case. Furthermore, asgrantRolescan only be called by theEDITION_MANAGER_ROLE, theEDITION_MINTER_ROLE` cannot ever be granted.

Impact

grantRole and revokeRole in Edition.sol cannot be called, while other functions using the onlyRolesOrOwner(EDITION_MANAGER_ROLE) modifier can only be invoked by the owner, which may be problematic if the owner is a contract thar also does not implement calls to those functions.

Code Snippet

https://github.com/sherlock-audit/2024-04-titles/blob/main/wallflower-contract-v2/src/TitlesCore.sol#L72-L96

Tool used

Manual Review

Recommendation

Implement calls in TitlesCore.sol to the functions stated above.

sherlock-audit / 2024-04-titles-judging

trachev - Several functions in Edition.sol cannot be called #361