Incorrect Fee Handling in Batch Minting

Summary

The mintBatch function in the Edition contract incorrectly handles Ether transactions when minting multiple tokens in a loop, leading to insufficient fee coverage.

Vulnerability Detail

In the mintBatch function, msg.value is used directly in the collectMintFee function for each iteration of the loop. As a result, the total Ether sent will either be insufficient to cover all fees.

Impact

This will lead to transactions failing due to insufficient fees for each minting operation.

Code Snippet

https://github.com/sherlock-audit/2024-04-titles/blob/main/wallflower-contract-v2/src/editions/Edition.sol#L277-L297

    function mintBatch(
        address to_,
        uint256[] calldata tokenIds_,
        uint256[] calldata amounts_,
        bytes calldata data_
    ) external payable {
        for (uint256 i = 0; i < tokenIds_.length; i++) {
            Work storage work = works[tokenIds_[i]];

            // wake-disable-next-line reentrancy
            FEE_MANAGER.collectMintFee{value: msg.value}(
                this, tokenIds_[i], amounts_[i], msg.sender, address(0), work.strategy
            );

            _checkTime(work.opensAt, work.closesAt);
            _updateSupply(work, amounts_[i]);
        }

        _batchMint(to_, tokenIds_, amounts_, data_);
        _refundExcess();
    }

Tool used

Manual Review

Recommendation

Modify the mintBatch function to calculate the required fee for each mint operation individually and then sum these to determine the total fee required for the batch. Only this amount should be sent to the FEE_MANAGER. Any excess Ether should remain in the contract balance to be refunded by _refundExcess.

Duplicate of #280