Zora

An attacker can front-run transactions and steal the newly minted NFTs. **Update 2021-01-06:** The Zora team presented the following pragmatic mitigation strategy: a user can mint the new media from an unclaimed address and claim such address once the mint has been confirmed. Furthermore, users with stolen tokens and high reputation can denounce such incidents and mint the media with a bit flip instead.

If a bid share is set to a value that is neither a multiple of 2 nor a multiple of 5, then only bid amounts that are a multiple of $$10^{20}$$ can be accepted. This may render the token untradable. **Update 2021-01-11:** The Zora team suggested the following mitigation tactic. A user with a NFT locked like this can create an ERC20 token for which his balance is $$10^{20}$$ and use this token to make a bid himself on the locked token. The bid can then restore the shares to sane values.

For a small price, spiteful users may deface NFTs before their target acquires them. **Update 2021-01-06:** This is mitigated in a similar manner to QSP-5.

A seller (or another colluding party) may place artificial bids on their own auctions to give gullible users the impression their media is worth more than it actually is.

The digest computed in `mintWithSig` does not depend on the media URIs. **Update 2021-01-06:** The issue has been mitigated by paying attention to the URI update events and having the owner fix the URIs if necessary, though a window of time wherein the URIs are defaced still exists.