Summary :

When the user create a listing to sell his assets using the function [list()](https://github.com/Cyfrin/2024-10-swan-dria/blob/main/contracts/swan/Swan.sol#L157-L192)
he have to give royalty fee to the buyer which is calculated by the function transferRoyalties() and send to the buyer as soon as the list is made.

Vulnerability Details :

In the below code :

the buyer's portion of royalty is send when the listing is created before the purchase is even made by the buyer.
the asset.royaltyFee is set by the buyer which ranges between [1,100].

Impact :

The malacious buyer will get the royalty fee without spending any of it's token and the seller have to relist the asset and have to give royalty fee again to another buyer.

Tools Used :

Manual review

Recommendations :

Transfer the buyer's portion of royality only if the purchase is made by the buyer otherwise transfer whole royalty as dreafee if assets is not sold.