Fractional v2 contest - Franfran's results

Lines of code

https://github.com/code-423n4/2022-07-fractional/blob/e2c5a962a94106f9495eb96769d7f60f7d5b14c9/src/FERC1155.sol#L223 https://github.com/code-423n4/2022-07-fractional/blob/e2c5a962a94106f9495eb96769d7f60f7d5b14c9/src/FERC1155.sol#L247

Vulnerability details

Impact

The royaltyPercent mapping doesn't have an upper bound (link 1), and seems to need it with an upper bound of 100 (link 2) as the divided value is 100, the unit is in percent. In a second market context, this could lead to misleading royalties, higher than the selling price. The marketplace contract should handle these exceptions, and in this case the sell could revert for all the tokens of this id.

Proof of Concept

No boundary set: https://github.com/code-423n4/2022-07-fractional/blob/e2c5a962a94106f9495eb96769d7f60f7d5b14c9/src/FERC1155.sol#L223

Usage here: https://github.com/code-423n4/2022-07-fractional/blob/e2c5a962a94106f9495eb96769d7f60f7d5b14c9/src/FERC1155.sol#L247

Tools Used

Pycharm

Recommended Mitigation Steps

Add an upper bound of 100 in the setRoyalties()

require(_percentage <= 100, "percentage too high!");