Beneficiary loses credit when specifying payment with flag _dontMint = true

Lines of code Vulnerability details Impact In the function processPayment, it will use provided JBDidPayData to mint to the beneficiary. The payment can specify some flags to help guiding how balance will be used to mint. There is a flag dontMint indicating if the transaction should not mint...

didPay() receives payment but does not mint NFT to beneficiary as expected.

Lines of code Vulnerability details Impact The function JB721Delegate.didPay is expected to mint an NFT to the beneficiary if conditions are met. However the function only receives payment through payable, but does nothing else in the processPayment call if function does not revert. The expected...

Contract locking eth

Lines of code Vulnerability details Impact The JB721Delegate contract contains payable functions, but no function to withdraw the ether. This would allow the ether sent to the contract to be unable to be withdrawn. JB721Delegate.didPay JB721Delegate.didRedeem Proof of Concept JB721Delegate.didPay...

Anyone can create a project with a forged JB721Delegate

Lines of code Vulnerability details Impact An attacker can create a project with a forged JB721Delegate fully controlled by the attacker. The contributors of such a malicious project will lost their funds. Proof of Concept function deployDelegateFor uint256 projectId, JBDeployTiered721DelegateDat...