MakersPlace CollectionCore Audit

The `constructor(...)` does not check if`_crsAddress` and `_creator` are different from address 0x0. Similarly, the `constructor()` does not validate if the `_royaltyPercentage` is within a valid range. Thus, any number (even exceeding 100%) can be passed to `_royaltyPercentage` with serious consequences. For instance, the computation of royalties in function `royaltyInfo(...)` will be compromised. The `_initialBaseURI` is not validated as well. There is no inline comment indicating the reason for the command `_pause()`. The code is reproduced below. ``` constructor(string memory _tokenName, string memory _tokenSymbol, address _crsAddress, uint256 _totalSupply, address _creator, uint16 _royaltyPercentage, string memory _initialBaseURI) ERC721(_tokenName, _tokenSymbol) { setCreatorRegistryStore(_crsAddress); require(_totalSupply > 0, "supply > 0"); // TODO: Should we have a higher limit for totalSupply totalMediaSupply = _totalSupply; creator = _creator; royaltyPercentage = _royaltyPercentage; baseURI = _initialBaseURI; _pause(); } ```

The contract is Ownable. `Ownable.sol` has the `function renounceOwnership()`. Although it can only be called by the `owner`, such a function leaves the contract without an owner, which surely compromises any ability to manage the contract. Below we present the code of this dangerous function. ``` function renounceOwnership() public virtual onlyOwner { _transferOwnership(address(0)); } ```

The `constructor(...)` has a comment stating that there is code to be implemented related to validating the upper limit for `total Supply`.

The function `mintTokens(...)` has code still to be implemented. The same piece of code is probably missing in the function `oboMintTokens(...)`.