-
Notifications
You must be signed in to change notification settings - Fork 6
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
CodeWasp - TitlesCore does not refund excess creation fee payment #348
Comments
Escalate This is a dup of #30 |
You've created a valid escalation! To remove the escalation from consideration: Delete your comment. You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final. |
Firstly, the escalation is asking to be a duplicate of #30 which is a duplicate itself. Secondly, we can consider duplicating it with #269 , but I believe this report is insufficient. From reading this report I see it as an opportunity loss and a user mistake to send excess ETH, cause the report doesn't mention that there is a functionality to refund it and why it doesn't work correctly. Planning to reject the escalation and leave the issue as it is. |
@WangSecurity Please reconsider. #30 itself is incorrectly grouped with #269: |
Yes, you're correct, just noticed it myself. The #30 is planned to be invalidated as well due to the following reasons: Excuse me, I believe this should remain invalid. Creation fee can only be changed by the owner, hence, there are two scenario's this issue may occur:
While in situation with mint fee, it's changed with by the work creator, who is not trusted. Planning to reject this escalation cause doesn't effect reward distribution |
@thpani @WangSecurity |
Result: |
Escalations have been resolved successfully! Escalation status:
|
CodeWasp
medium
TitlesCore does not refund excess creation fee payment
Summary
Funds sent to
TitlesCore.createEdition()
orTitlesCore.publish()
exceeding the necessary creation fee are stuck in the contract.Vulnerability Detail
TitlesCore
does not refund excess payment on creation fees.Impact
Excess fee payment is stuck in contract.
Code Snippet
https://github.com/sherlock-audit/2024-04-titles/blob/main/wallflower-contract-v2/src/TitlesCore.sol#L72-L74
https://github.com/sherlock-audit/2024-04-titles/blob/main/wallflower-contract-v2/src/TitlesCore.sol#L103-L105
Tool used
Manual Review
Recommendation
Refund excess fees in
TitlesCore._publish()
.The text was updated successfully, but these errors were encountered: