Lack of input validation to check whether the tokenId of the NFT exists or not - this lead to misallocation of fee earned

Lines of code Vulnerability details Impact In the distributeFees function, there is no input validation to check whether the tokenId of the NFT exists or not. If a caller inputs tokenId that does not exist, the fee earned will be added to the balance of tokenId that does not exist. Although this...

launchProjectFor() does not check the address of _owner

Lines of code Vulnerability details Impact launchproject can be launchProject in launchProjectFor, but the entire process does not check the validity of owner, not even JBController.sol. This will enable owner to be specified as address0. This will enable projects to be created without an owner,...