-
Notifications
You must be signed in to change notification settings - Fork 6
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
ubl4nk - TitlesCore#_publish is not returning back the excess funds to Edition/Works creator #36
Comments
escalate |
You've created a valid escalation! To remove the escalation from consideration: Delete your comment. You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final. |
Escalation should be rejected. This is a design recommendation for the protocol team, there is no security issue. |
@Evert0x @WangSecurity |
I believe with admins of the protocol being trusted, it's not a valid scenario. Specifically, this aspect of the trsuted admin rule:
Hence, decision remains the same, reject the escalation and leave the issue as it is. |
Result: |
Escalations have been resolved successfully! Escalation status:
|
ubl4nk
medium
TitlesCore#_publish is not returning back the excess funds to Edition/Works creator
Summary
TitlesCore#_publish is not returning back the excess funds to Edition/Works creator which may lead to loss of funds for Edition/Work creator.
Vulnerability Detail
There is no functionality to return the excess funds to the Edition/Work creator in
_publish
function and due to it, 2 scenarios might happen which will lead to loss of funds for creator.Scenario_1:
publish
to publish a new work (or callscreateEdition
to create new Edition and publish a new work)It collects a
protocolCreationFee
, this means Alice should pay aprotocolCreationFee
for creation of new works.protocolCreationFee
, Alice will lose the excess Ethers/Funds who paid forprotocolCreationFee
(this is because the function is not returning the extra funds to Alice)Scenario_2:
protocolCreationFee
is 0.2 ETHpublish
to publish a new worksetProtocolFees
and decreases theprotocolCreationFee
to 0.1 ETHpublish
is not returning the excess funds)Impact
Edition/Works creators may experience a loss while creating new works.
Code Snippet
https://github.com/sherlock-audit/2024-04-titles/blob/c9d16782a7d3c15c7a759f22c9e0552d5e777ed7/wallflower-contract-v2/src/TitlesCore.sol#L138
https://github.com/sherlock-audit/2024-04-titles/blob/c9d16782a7d3c15c7a759f22c9e0552d5e777ed7/wallflower-contract-v2/src/fees/FeeManager.sol#L166-L174
https://github.com/sherlock-audit/2024-04-titles/blob/c9d16782a7d3c15c7a759f22c9e0552d5e777ed7/wallflower-contract-v2/src/fees/FeeManager.sol#L298-L316
Tool used
Manual Review
Recommendation
Consider returning the extra funds in
publish
.The text was updated successfully, but these errors were encountered: