TITLES Publishing Protocol audit contest
A public audit contest on Sherlock (referential NFT publishing), completed on 22nd April 2024. 0xSimao placed #8. 8 of his findings are published: 2 high severity and 6 medium.
What TITLES Publishing Protocol is
TITLES builds creative tools powered by artist-owned AI models. The underlying TITLES protocol enables the publishing of referential NFTs, including managing attribution and splitting payments with the creators of the attributed works.
Scope
The publishing protocol: edition creation and minting through the factory, the fee router and attribution splits.
High severity findings
- Users can exploit the batch minting feature to avoid paying minting fees for tokens
- Collection referrers will not receive their share of the minting fee
Medium severity findings
- Incorrect encoding of bytes for EIP712 digest in
TitleGraphcauses signatures generated by common EIP712 tools to be unusable - New creators unable to update the royalty target and the fee route for their works
- Incompatibility of Upgradeability Pattern in TitlesGraph Contract
- FeeManager's admin cannot grant or revoke any role
- Malicious users can block creators from acknowledging or deacknowledging an edge
- Signature is malleable
The contest