Existing tokens can be given to other contracts when assign function is called

Lines of code Vulnerability details Impact In the Turnstile contract when the assign function is called any unregistered contract can register himself as the feeRecipient for any given token id, but in reality only the token owner should be able to assign a new smart contract as feeRecipient for...

ERC721Votes: Token owners can double voting power through self delegation

Lines of code Vulnerability details The owner of one or many ERC721Votes tokens can double their voting power once and only once by delegating to their own address as their first delegation. Scenario This exploit relies on the initial default value of the delegation mapping in ERC721Votes, which ...

Use safeTransfer instead of transferFrom

Lines of code Vulnerability details Impact In the following line, transferFrom is used. However, this function transfers funds from CoreCollection contract to msg.sender. That's why transfersafeTransfer must be used. Like the comment describes, if a royalty vault isn't set, tokens are kept within...