What Did I Miss from the Titles Publishing Protocol Contest?
The Titles Publishing audit competition on Sherlock has wrapped up, and it's time to review the results to see what I missed. I submitted four findings, three of which were validated, resulting in one High and two Medium findings, earning me a modest $5. This contest had an unprecedented number of duplicates, a testament to how we are all getting sharper at spotting issues.
The final audit report included three High and twelve Medium findings. Let’s dive into the two High severity issues I missed and two notable Medium severity findings that should have been caught.
Severity: High
Reward: $1,371
Title: Original collection referrer will be overwritten when a new collection/work is created - https://github.com/sherlock-audit/2024-04-titles-judging/issues/265 -
Titles Publishing allows users to create NFT collections and different works within each collection or Edition as they call them. They offer revenue sharing for individuals who refer others to mint Works or Collections. The issue here is that when a new Edition or Work is created, the original edition referrers are overwritten. Titles failed to properly track the correct referrer for each Edition or Work.
Severity: High
Reward: $3
Title: Collection referrers will not receive their share of the minting fee - https://github.com/sherlock-audit/2024-04-titles-judging/issues/267
Similar to the other High finding, the implementation for minting and collection referrals is flawed. The collection fee is routed to the mint referrer instead of the collection referrer. Additionally, a user can set themselves as the referrer, thereby avoiding paying the proper referrer their fee. This was a forehead-slapping moment for me because I missed a similar issue in a Nouns audit. This one is definitely going on my checklist.
Severity: Medium
Reward: $406
Title: CREATE opcode works differently in the zkSync chain - https://github.com/sherlock-audit/2024-04-titles-judging/issues/91
Titles Publishing is set to deploy on multiple chains: Ethereum, Base, OP, Zora, Blast, Arbitrum, zkSync, and Degen. On the zkSync chain, the CREATE and CREATE2 opcodes behave slightly differently than on Ethereum. This difference means Editions cannot be created, and any attempts to do so will result in lost funds. I was unaware of this nuance and will be sure to note it for any future zkSync-related audits.
Severity: Medium
Reward: $1,505
Title: Malicious EDITION_MANAGER_ROLE can front-run victims to increase royalty - https://github.com/sherlock-audit/2024-04-titles-judging/issues/285
This finding demonstrates that someone with the EDITIONS_MANAGER_ROLE can monitor transactions that purchase these NFTs and front-run the purchase to increase the royalty fee, effectively stealing the majority of the purchase cost. This single Medium finding earned the highest reward of the contest. The key takeaway for me is to pay close attention to different roles and their implications in each audit within the context of the specific audit platform. Additionally, I need to double-check EIPs I'm unfamiliar with.