NFJLabs

In the revenue sources section of NFJ labs whitepaper, it states that the intended royalty for every nft minted on their platform will be 2.5% derivation on a trade. The allocation that goes to the platform was also cited in the whitepaper to be 10% on all trades made on an NFT. However, this business logic is not exactly captured in the contract. The present design architecture allows platform owners and nft creators to set platformFee and royalties to arbitrary values. Malicious NFT creators can mint on the platform and hike royalties so high in order to get a proportion of the funds greater than 2.5%. The following critical functions do not have input validation checks  • initialize(),  • mintNFT(),  • updatePlatformDetails(), • updateNFTRoyalty()

In contract, some view functions were created to return some state variables but these functions were not called within the contract. The functions are as follows:• getTotalNFTCount • getRoyaltyAndPlatformFeeDetails The visibility of the function is public. However, it is not being called in the contract. It is only called externally. Hence it is recommended to declare such functions as external in order to save gas.

to maintain clean code, it is required to remove unused variables in the contract. Although MAX_BPS being a constant variable, doesn’t add up to the contract bytecode but this variable was never used within the contract.