The tier reserved rate is not validated and can surpass JBConstants.MAX_RESERVED_RATE

Lines of code Vulnerability details If the reserved rate of a tier is set to a value JBConstants.MAXRESERVEDRATE, the JBTiered721DelegateStore.numberOfReservedTokensOutstandingFor function will return way more outstanding reserved tokens up to 6 times more than allowed - 2^16 - 1 due to the manua...

Incorrect calculation of totalRedemptionWeight in JBTiered721DelegateStore.sol, we use weight + number of reserved token instead of weight + weight

Lines of code Vulnerability details Impact After NFT minted, the NFT has redemption weight based on the contribution floor price, the logic that calculate the total redemption weight is storedTier = storedTierOfnfti + 1; // Add the tier's contribution floor multiplied by the quantity minted. weig...

Owner can set contribution floor to 0 , meaning the user lose the fund / fee for 0 contribution power NFT and NFT have no redemption weight

Lines of code Vulnerability details Impact Owner can set contribution floor to 0, meaning the user lose the fund / fee for 0 contribution power NFT and NFT have no redemption weight. the normal payment flow for user is Payment Terminal - pay - didPay - processPayment - // Mint rewards if they wer...