Dria

Summary

The royalty fee is paid to the buyer and not to the seller making basically a discount for the buyer. The higher the fee, the higher the discount. What is more, the whole fee is paid by seller which does not make any sense.

Vulnerability Details

When listing/relisting through Swan::list and Swan::relist a royalty fee is paid. This happens in the transferRoyalties function:

We can look at this comment Function to transfer the royalties to the seller & Dria.
By design this royalty should go to the owner of the protocol and to the seller. However, when we look at the code we see a different picture - the whole fee is paid by the seller. A part of it goes to the buyer and the rest goes to the protocol owner. This means that with this current implementation the buyer receives a discount with every purchase because a part of the price is sent back to him as a fee. The higher the fee, the higher the discount.

Impact

There is an incentive loss of using this protocol to sell NFT as the price that is set by the seller is not the price they will receive on sell. Such a vulnerability will undermine the trust in the protocol and disincentivise users to use it.

Tools Used

Manual Review

Recommendations

Change the transferRoyalties function to work in the following way:

• The whole fee is paid by the buyer.

  • A part of it goes to the seller.

  • The rest goes to the protocol owner.