Upgraded Q -> H from 45 [1655007594160]

Judge has assessed an item in Issue 45 as High risk. The relevant finding follows: Impact The CoreCollection initialize function is missing the onlyUnInitialized function. The onlyUnInitialized modifier is not used in the contract right now and this allows the initialize function to be called mor...

Upgraded Q -> H from 63 [1655008454311]

Judge has assessed an item in Issue 63 as High risk. The relevant finding follows: Function CoreCollection:initialize can be executed by owner after initialisation and state variables like mintFee, maxSupply can be changed to increase/decrease fee and supply, isForSale can be set to false to stop...

Initializer can be called many times and change critical parameters in an existing collection

Lines of code Vulnerability details Impact Anyone can create a collection so the owner is not a trusted actor. Someone can create a collection with a maxSupply and then call initialize again to increase it. Also, the creator can use it to change price and front-run a mint with an arbitrary bigger...

No reentrancy guard on mint() function that has a callback

Lines of code Vulnerability details Impact the mint function calls mint which has a callback to the "to" address argument. Functions with callbacks should have reentrancy guards in place for protection against possible malicious actors both from inside and outside the protocol. Proof of Concept...

Use safeTransfer instead of transferFrom

Lines of code Vulnerability details Impact In the following line, transferFrom is used. However, this function transfers funds from CoreCollection contract to msg.sender. That's why transfersafeTransfer must be used. Like the comment describes, if a royalty vault isn't set, tokens are kept within...

CoreCollection.setRoyaltyVault doesn't check royaltyVault.royaltyAsset against payableToken, resulting in potential permanent lock of payableTokens in royaltyVault

Lines of code Vulnerability details Impact Each CoreProxy is allowed to be associated with a RoyaltyVault, the latter which would be responsible for collecting minting fees and distributing to beneficiaries. Potential mismatch between token used in CoreProxy and RoyaltyVault might result in minti...