Inconsistency in fee distribution

[code423n4]

Handle

csanuragjain

Vulnerability details

Impact

Inconsistent fee disbursal

Proof of Concept

1. Navigate to contract https://github.com/code-423n4/2021-12-nftx/blob/main/nftx-protocol-v2/contracts/solidity/NFTXSimpleFeeDistributor.sol

2. Lets see distribute function and assume there are 5 feeReceivers

3. Assume that distribution to 4 feeReceivers was success and loop is on last feeReceivers

  function distribute(uint256 vaultId) external override virtual nonReentrant {
    ...

    for (uint256 i = 0; i < length; i++) {
      FeeReceiver memory _feeReceiver = feeReceivers[i];
      ...
      if (!complete) {
        leftover = amountToSend;
      } else {
        leftover = 0;
      }
    }

    if (leftover > 0) {
      uint256 currentTokenBalance = IERC20Upgradeable(_vault).balanceOf(address(this));
      IERC20Upgradeable(_vault).safeTransfer(treasury, currentTokenBalance);
    }
  }

3. Assume the transfer on last fee receiver was not success and leftover came to be 10. Also lets say currently vault balance for contract is 20.

4. Now since leftover >0 so full vault balance is calculated and is sent to treasury

if (leftover > 0) {
      uint256 currentTokenBalance = IERC20Upgradeable(_vault).balanceOf(address(this));
      IERC20Upgradeable(_vault).safeTransfer(treasury, currentTokenBalance);
    }

5. This is inconsistent, because if last fee receiver transfer was success then only amount 10 would have deducted from vault balance for this contract

Recommended Mitigation Steps

Change the condition

if (leftover > 0) {
      IERC20Upgradeable(_vault).safeTransfer(treasury, leftover);
    }