FNCY security record

The function `_checkHasMinted()` is used to ensure that mint functions such as `mint()`, `bulkMint()`, `merchantSelfMint()`, and `bulkMerchantSelfMint()` keep track of minted tokens so that they do not get minted more than once. Since the value of `hasMinted` is never set nor updated, it will always retain its default value of `false`, therefore users can repeatedly call the minting functions to mint tokens more than once with the same parameters. ```solidity=110 bytes32 hash = _hash(collectionConfig, to, nftId, tokenId); require(_verify(collectionConfig, hash, signature), "Mint Failed Authorization"); uint256 rTokenId = 0; _checkHasMinted(collection, nftId); (success, rTokenId) = _mint(collectionConfig, to, tokenId, uri); ``` ```solidity=227 function _checkHasMinted(address collection, uint256[] memory nftIds) internal view { for (uint8 i = 0; i < nftIds.length; i++) { require(!hasMinted[collection][nftIds[i]], "Already Minted"); } } function _checkHasMinted(address collection, uint256 nftId) internal view { require(!hasMinted[collection][nftId], "Already Minted"); } ```

This `sell` function allows a user to list an NFT for sale. It requires that the provided `_deadline` be greater than the current block timestamp and also greater than the existing deadline for that NFT (`_deadline > deadlines[_nftAddress][_tokenId]`). ```solidity function sell(address _nftAddress, uint256 _tokenId, uint256 _price, uint256 _deadline) public nonReentrant whenNotPaused { require(_deadline >= block.timestamp, "NFTExchange: Expired order"); ... require(_deadline > deadlines[_nftAddress][_tokenId], "NFTExchange: invalid deadline"); deadlines[_nftAddress][_tokenId] = _deadline; ... } ``` However, there is no mechanism to delete or reset the `deadlines[_nftAddress][_tokenId]` mapping. If a user sets the deadline for an NFT (`deadlines[_nftAddress][_tokenId]`) to the maximum value of uint256 (which is `2^256 - 1`), this deadline will essentially never be exceeded by a new deadline value. Once the deadline is set to this maximum value, the sell function cannot be successfully called for that particular `[_nftAddress][_tokenId]` combination again.

There is an issue in function `sellForOffer()` that will prevent the function from properly executing. When `offerPrice` is greater than 0, there are no funds to be distributed to the seller and the other fee recipients when the internal call to `executeFundsTransfer()` is made. This will cause the function `sellForOffer()` to be unusable. ```solidity=192 if (offeredPrice > 0) { // require(IExchangeFeeInterceptor(interceptors[_nftAddress]).collections(_nftAddress).enable, 'need to setup interceptor'); IExchangeFeeInterceptor(interceptors[_nftAddress]).executeFundsTransfer(_nftAddress, seller, _tokenId, offeredPrice); } ``` Unlike other calls to the function `executeFundsTransfer()`, there is no execution of `TransferHelper.safeTransferETH()` beforehand. ```solidity if (offerPrice > 0) { TransferHelper.safeTransferETH(interceptors[nftAddress], offerPrice); IExchangeFeeInterceptor(interceptors[nftAddress]).executeFundsTransfer(nftAddress, tokenOwner, tokenId, offerPrice); } ```

There is an issue related to the management of privileged roles that would allow users of a privileged role the power to add and remove other users who are also under privileged roles. Any exploit can result in the abuse of this power to remove other users from such privileged roles. ### NFTLaunchpad The function `setAdmin()` allows other admins to add or remove each other from the list of admins. ### TransferManagement Members of each role can add new members to this role and can also add and remove members from different other roles.

The following functions can be a target of a re-entrancy attempt since they do not use the `nonReentrant` modifier. This could potentially cause issues and possible damage for the project if not handled appropriately. ```solidity=163 function cancelSell(address _nftAddress, uint256 _tokenId) public whenNotPaused { require(lists[_nftAddress][_tokenId].seller == msg.sender, 'NFTExchange: Only Seller can cancel sell token'); IERC721Upgradeable nft = IERC721Upgradeable(_nftAddress); nft.safeTransferFrom(address(this), msg.sender, _tokenId); delete lists[_nftAddress][_tokenId]; emit CancelAsk(msg.sender, _nftAddress, _tokenId); } ``` The following case is a bit more unique in the sense that it could be used within a re-entrancy attack to make changes that could benefit the attacker. For example, if an exploiter is able to take over the admin role, function `setTradingConfig()` can be used to modify the interceptors to another malicious contract or addresses of choice while the attack is being executed. ```solidity=238 function setTradingConfig(address _nftAddress, address _interceptorAddress) public onlyAdmin { require(address(0) != _nftAddress && address(0) != _interceptorAddress, "require trading config nft and interceptor address"); interceptors[_nftAddress] = payable(_interceptorAddress); } ```

The way that the `claimOfferedHash` is generated could lead to potential replay attacks since there is no way to identify whether the hash has been previously used or not and can potentially be used again. ```solidity function claimOffered(address nftAddress, uint256 tokenId, uint256 deadline, uint256 offerPrice, bytes calldata offeredHash, bytes memory permitSig) external payable nonReentrant whenNotPaused { ... bytes32 claimOfferedHash = _claimOfferedHash(nftAddress, tokenId, tokenOwner, buyer, offerPrice); require(_verify(tokenOwner, claimOfferedHash, offeredHash), "ClaimOffered::Invalid Signature"); ... } ```

As a best practice, the `nonReentrant` modifier could be placed and executed before other modifiers in functions to prevent reentrancies through other modifiers and make code more efficient. To follow the best practice, please consider placing the `nonReentrant` modifier before the modifiers in the following functions. ```solidity function mint( address collection, address to, uint256 nftId, uint256 tokenId, string memory uri, bytes calldata signature ) external onlySpecialMembers nonReentrant whenNotPaused returns (bool success) { ``` ```solidity function bulkMint( address collection, address[] calldata recipients, uint256[] calldata nftIds, uint256[] calldata tokenIds, string[] calldata uris, bytes calldata signature ) external onlySpecialMembers nonReentrant whenNotPaused ``` ```solidity function merchantSelfMint(address collection, address to, uint256 nftId, uint256 tokenId, string memory uri) external onlyMerchant(collection) nonReentrant whenNotPaused returns(bool success, uint256 rTokenId) { ``` ```solidity function bulkMerchantSelfMint(address collection, address[] calldata recipients, uint256[] calldata nftIds, uint256[] calldata tokenIds, string[] calldata uris) external onlyMerchant(collection) nonReentrant whenNotPaused { ```

It was noted that the role `SPECIAL_ROLE` has access to special minting functions such as `buyFromAnotherChain()` and `entryWithSpecial()`. The audit team would like to understand the use of this role and the members that this role will consist of.

The function `buyFromAnotherChain()` allows users with the role `SPECIAL_ROLE` to mint NFTs from another chain. The audit team would like to better understand how this function will be used and the process of minting NFTs from other chains. It seems that there is an input parameter called `receipt` used to mark the mapping `anotherReceipts[]` as true so that multiple duplicate mints do not occur, however based on the current implementation, more information is required to understand the current implementation.

One or more parameters with `memory` data location are never modified in their functions and those functions are never called internally within the contract. Thus, their data location can be changed to `calldata` to avoid the gas consumption copying from calldata to memory. ```solidity=82 function addProject( ``` `addProject` has memory location parameters: `paymentTokens`. --- ```solidity=116 function updateProject( ``` `updateProject` has memory location parameters: `paymentTokens`. --- ```solidity=199 function buyFromAnotherChain(address user, uint256 projectId, uint8 count, string memory receipt, uint256 chainId) public onlySpecial onlyAvailable(projectId) { ``` `buyFromAnotherChain` has memory location parameters: `receipt`. --- ```solidity=222 function entryWithSpecial(address user, uint256 projectId, uint8 count, string memory receipt) public onlySpecial onlyAvailable(projectId) { ``` `entryWithSpecial` has memory location parameters: `receipt`.