artistSignature can be replaced in setCollectionData function with zero collectionTotalSupply

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/NextGenCore.sol#L150
https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/NextGenCore.sol#L257

Vulnerability details

Impact
Collection admin can overwrite the collectionArtistAddress when the collectionTotalSupply is zero.
This can lead to confusion, incorrect attribution of artwork ownership, and potential disputes between artists and collection administrators.
Proof of Concept
The vulnerability exists in the setCollectionData function, allowing the collection admin to replace the collectionArtistAddress when the current collectionTotalSupply is zero.
This inconsistency occurs as the collection admin can update the collectionArtistAddress.
Consequently, this prevents the intended artist from registering their signature for the selected collectionId.

1. collection admin calls the setCollectionData function for the first time and the _collectionTotalSupply is zero, and the _collectionArtistAddress is A
   https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/NextGenCore.sol#L147
2. artist A calls the artistSignature function to register his signature.
   https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/NextGenCore.sol#L257
3. collection admin calls setCollectionData again with another artist B, it can be updated successfully because the collectionTotalSupply is zero.
   https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/NextGenCore.sol#L149
4. However, artist B cannot update the artistSignature because it has already been registered by artist A.
   https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/NextGenCore.sol#L257

Tools Used
Manual Review
Recommended Mitigation Steps
Provide function to update artistSignature

Assessed type

Access Control

[c4-pre-sort]

141345 marked the issue as sufficient quality report

[c4-pre-sort]

141345 marked the issue as primary issue

[c4-sponsor]

a2rocket (sponsor) disputed

[a2rocket]

once the collection supply is not set the artist can change. When the collectionSupply is set but artist did not sign yet, the address can change. When the artists signed it cannot change. This is the intended design.

[c4-judge]

alex-ppg marked issue #741 as primary and marked this issue as a duplicate of 741

[c4-judge]

alex-ppg marked the issue as partial-50