MakersPlace CollectionCore Audit

When smart contracts are deployed or their associated functions are invoked, the execution of these operations always consumes a certain quantity of gas, according to the amount of computation required to accomplish them. Modifying an unknown-size array that grows in size over time can result in a Denial-of-Service attack. Simply by having an excessively huge array, users can exceed the gas limit, therefore preventing the transaction from ever succeeding.

[`isApprovedForAll`](https://github.com/yashh/collection/blob/master/contracts/CollectionCore.sol#L130) is a check for an oboApproval list for the event of an OBO operator being compromised. A better implementation of this is to use a multisig account where there are defined patterns for user management for this specific event.

The function `setBaseURI(...)` does not validate the input parameter. Thus, any string can be inserted as the `baseURI`. However, there are basic checks that can be implemented to assure that the string is properly formatted (`ipfs://<hash>`). The code is reproduced below: ``` function setBaseURI(string memory _newBaseURI) external onlyOwner whenNotPaused { require(isImmutable == false, "cant change"); baseURI = _newBaseURI; } ```

The constructor does not emit an event when it has been called. This is useful for monitoring post-deployment which arguments were passed and validation of correct parameters.