NextGen - zach's results

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/NextGenCore.sol#L150 https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/NextGenCore.sol#L257

Vulnerability details

Impact Collection admin can overwrite the collectionArtistAddress when the collectionTotalSupply is zero. This can lead to confusion, incorrect attribution of artwork ownership, and potential disputes between artists and collection administrators. Proof of Concept The vulnerability exists in the setCollectionData function, allowing the collection admin to replace the collectionArtistAddress when the current collectionTotalSupply is zero. This inconsistency occurs as the collection admin can update the collectionArtistAddress. Consequently, this prevents the intended artist from registering their signature for the selected collectionId.

1. collection admin calls the setCollectionData function for the first time and the _collectionTotalSupply is zero, and the _collectionArtistAddress is A https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/NextGenCore.sol#L147
2. artist A calls the artistSignature function to register his signature. https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/NextGenCore.sol#L257
3. collection admin calls setCollectionData again with another artist B, it can be updated successfully because the collectionTotalSupply is zero. https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/NextGenCore.sol#L149
4. However, artist B cannot update the artistSignature because it has already been registered by artist A. https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/NextGenCore.sol#L257

Tools Used Manual Review Recommended Mitigation Steps Provide function to update artistSignature

Assessed type

Access Control