Blokhaus Announced Launching of New Open-Source NFT Tool Minterpress

By Deeba Ahmed Minterpress is a new open-source plugin that allows collectors and creators to host and mint eco-friendly NFTs on WordPress. This is a post from HackRead.com Read the original post: Blokhaus Announced Launching of New Open-Source NFT Tool Minterpress...

deployHolographableContract() uniqueness

Lines of code Vulnerability details Impact The holographable smart contract deployment can not guarantee the uniqueness. A malicious user could deploy multiple duplicate contracts, then the brigeIn could not make sure the uniqueness of the minted or burned NFT. Proof of Concept The salt and...

LayerZeroModule miscalculates gas, risking loss of assets

Lines of code Vulnerability details Description Holograph gets it's cross chain messaging primitives through Layer Zero. To get pricing estimate, it uses the DstConfig price struct exposed in LZ's RelayerV2 The issue is that the important baseGas and gasPerByte configuration parameters, which are...

setRoyalties can lead to royalties set to greater than 100%, breaking royalty functionality

Lines of code Vulnerability details enforcer/PA1D can be used by NFT smart contracts to provide royalty info. The owner can call setRoyalties to set the royalties for a specific token id, or the default royalty of the collection. Marketplaces implementing EIP-2981 can then use royaltyInfo to get...

MED: isOwner / onlyOwner checks can be bypassed by attacker in ERC721/ERC20 implementations

Lines of code Vulnerability details Description ERC20H and ERC721H are base contracts for NFTs / coins to inherit from. They supply the modifier onlyOwner and function isOwner which are used in the implementations for access control. However, there are several functions which when using these the...

MED - Royalty system couples receiving address and collection request address, which may cause marketplaces to not be able to collect.

Lines of code Vulnerability details Description Royalties are managed in PA1D.sol. Owner configures several addresses which will get percentages of tokens owned by the contract. However, to receive the payout caller must be one of the eligible addresses, or the owner. This is an issue because the...

MED - NFTs become no longer holographable once new factory is connected.

Lines of code Vulnerability details Description The basic premise of the Holograph platform is that NFTs / ERC20s are holographable, in other words they will have the same address across all ERC20 compatible blockchains. This invariant is used countless times in the code base. For example, when...

_payoutToken() breaks if tokenAddress is USDT - for Ethereum contracts.

Lines of code Vulnerability details If USDT is used for a sale at some point - either through a direct sale on the NFT collection, or sent to the collection from a marketplace sale - it will remain in the contract, as getTokenPayoutaddressUSDT calls systematically revert: on Ethereum, USDT.transf...

Beneficiary credit balance can unwillingly be used to mint low tier NFT

Lines of code Vulnerability details Impact In the function processPayment, it will use provided JBDidPayData from JBPaymentTerminal to mint to the beneficiary. The value from JBDidPayData will be sum up with previous credits balance of beneficiary. There are 2 cases that beneficiary credit balanc...

Redemption weight of tiered NFTs miscalculates, making users redeem incorrect amounts - Bug #1

Lines of code Vulnerability details Description Redemption weight is a concept used in Juicebox to determine investor's eligible percentage of the non-locked funds. In redeemParams, JB721Delegate calculates user's share using: uint256 redemptionWeight = redemptionWeightOfdecodedTokenIds; uint256...

Beneficiary loses credit when specifying payment with flag _dontMint = true

Lines of code Vulnerability details Impact In the function processPayment, it will use provided JBDidPayData to mint to the beneficiary. The payment can specify some flags to help guiding how balance will be used to mint. There is a flag dontMint indicating if the transaction should not mint...

The tier reserved rate is not validated and can surpass JBConstants.MAX_RESERVED_RATE

Lines of code Vulnerability details If the reserved rate of a tier is set to a value JBConstants.MAXRESERVEDRATE, the JBTiered721DelegateStore.numberOfReservedTokensOutstandingFor function will return way more outstanding reserved tokens up to 6 times more than allowed - 2^16 - 1 due to the manua...

Deactivated tiers can still mint reserve tokens, even if no non-reserve tokens were minted.

Lines of code Vulnerability details Description Tiers in Juicebox can be deactivated using the adjustTiers function. It makes sense that reserve tokens may be minted in deactivated tiers, in order to be consistent with already minted tokens. However, the code allows the first reserve token to be...

NFT not minted when contributed via a supported payment terminal

Lines of code Vulnerability details Impact A contributor won't get an NFT they're eligible for if the payment is made through a payment terminal that's supported by the project but not by the NFT delegate. Proof of Concept A Juicebox project can use multiple payment terminals to receive...

didPay() receives payment but does not mint NFT to beneficiary as expected.

Lines of code Vulnerability details Impact The function JB721Delegate.didPay is expected to mint an NFT to the beneficiary if conditions are met. However the function only receives payment through payable, but does nothing else in the processPayment call if function does not revert. The expected...

Silent returns in _processPayment may cause users to lose assets

Lines of code Vulnerability details Impact The processPayment function of the JBTiered721Delegate contract is used to mint NFT for the user after receiving the tokens sent by the user. When the token sent by the user differs from pricingCurrency, it tries to get the corresponding price via...

NFT Owner can keep add new tiers to increase the NFT supply with no upper limit to dilute the redemption power of the NFT from old tiers

Lines of code Vulnerability details Impact Owern can adjust tiers, adding tiers with no restriction. function adjustTiersJB721TierParams calldata tiersToAdd, uint256 calldata tierIdsToRemove // Add the tiers. if numberOfTiersToAdd != 0 // Record the added tiers in the store. uint256 memory...

Upgraded Q -> M from 236 [1666363743332]

Judge has assessed an item in Issue 236 as Medium risk. The relevant finding follows: ERC721 token can be lost in fillAsk PROBLEM When a user fills an ask order by calling fillAsk, the ERC721.transferFrom method is used to transfer the NFT to the receiver. Should the receiver be a smart contract...

Incorrect calculation of totalRedemptionWeight in JBTiered721DelegateStore.sol, we use weight + number of reserved token instead of weight + weight

Lines of code Vulnerability details Impact After NFT minted, the NFT has redemption weight based on the contribution floor price, the logic that calculate the total redemption weight is storedTier = storedTierOfnfti + 1; // Add the tier's contribution floor multiplied by the quantity minted. weig...

The tier setting parameter are unsafely downcasted from type uint256 to type uint80 / uint48 / uint40 / uint16

Lines of code Vulnerability details Impact The tier setting parameter are unsafely downcasted from uint256 to uint80 / uint48 / uint16 the tier is setted by owner is crucial because the parameter affect how nft is minted. the the callstack is JBTiered721Delegate.solinitialize - StorerecordAddTier...