# TITLES Publishing Protocol audit contest Sherlock · Referential NFT publishing · 22nd April 2024 · #8 A public audit contest on Sherlock (referential NFT publishing), completed on 22nd April 2024. 0xSimao placed #8. 8 of his findings are published: 2 high severity and 6 medium. ## What TITLES Publishing Protocol is TITLES builds creative tools powered by artist-owned AI models. The underlying TITLES protocol enables the publishing of referential NFTs, including managing attribution and splitting payments with the creators of the attributed works. ## Scope The publishing protocol: edition creation and minting through the factory, the fee router and attribution splits. ## High severity findings - [Users can exploit the batch minting feature to avoid paying minting fees for tokens](https://0xsimao.com/findings/titles-publishing-protocol-exploit-feature-avoid-fees) - [Collection referrers will not receive their share of the minting fee](https://0xsimao.com/findings/titles-publishing-protocol-collection-referrers-share-fee) ## Medium severity findings - [Incorrect encoding of bytes for EIP712 digest in `TitleGraph` causes signatures generated by common EIP712 tools to be unusable](https://0xsimao.com/findings/titles-publishing-protocol-encoding-digest-tools-unusable) - [New creators unable to update the royalty target and the fee route for their works](https://0xsimao.com/findings/titles-publishing-protocol-creators-unable-fee-works) - [Incompatibility of Upgradeability Pattern in TitlesGraph Contract](https://0xsimao.com/findings/titles-publishing-protocol-incompatibility-upgradeability-titles-graph) - [FeeManager's admin cannot grant or revoke any role](https://0xsimao.com/findings/titles-publishing-protocol-fee-cannot-grant-revoke) - [Malicious users can block creators from acknowledging or deacknowledging an edge](https://0xsimao.com/findings/titles-publishing-protocol-creators-acknowledging-deacknowledging-edge) - [Signature is malleable](https://0xsimao.com/findings/titles-publishing-protocol-signature-malleable) ## The contest [View the contest page](https://audits.sherlock.xyz/contests/326)