mintFromFixedPriceSale for a custom contract can lead to users losing funds

Lines of code Vulnerability details mintFromFixedPriceSale for a custom contract can lead to users losing funds NFTDropMarketFixedPriceSale.createFixedPriceSale allows creators to create a sale drop. A creator can create a drop sale for their custom NFT Contract that adheres to...

Order partial fulfilling can be blocked by the first fulfiller

Lines of code Vulnerability details DOS attack is possible as OrderValidator.validateOrderAndUpdateStatus sets order's numerator and denominator based on an arbitrary fulfiller provided input. When there is a large bulk sale, an attacker can become one of the first buyers partial fulfillers and s...

_getCreatorPaymentInfo() is Not Equipped to Handle Reverts on an Unbounded _recipients Array

Lines of code Vulnerability details Impact The getCreatorPaymentInfo function is utilised by distributeFunds whenever an NFT sale is made. The function uses try and catch statements to handle bad API endpoints. As such, a revert in this function would lead to NFTs that are locked in the contract...

Missing zero/threshold check for NFT sale duration

Handle 0xRajeev Vulnerability details Impact A zero or some minimum threshold check is missing for saleDuration parameter of startSale function which sets the duration of the public sale of NFTs. If accidentally set to 0 then sales happen at zero price according to the logic in getPrice leading t...