lemonmon - FootiumClub contract not implementing EIP2981 which may result in a loss of royalties

[sherlock-admin]

lemonmon

medium

FootiumClub contract not implementing EIP2981 which may result in a loss of royalties

Summary

When selling players, the protocol is collecting royalties, since FootiumPlayer.sol is implementing the EIP2981 standard. However FootiumClub.sol is not implementing the EIP2981 standard, thus no royalties are collected when selling FootiumClub nfts due to the missing EIP2981 implementation.

Vulnerability Detail

The contract FootiumClub is lacking the implementation of the EIP2981 standard (line 14-20 in FootiumClub.sol), so no royalties can be collected when a club is sold/bought.

EIP2981 summary:

A standardized way to retrieve royalty payment information for non-fungible tokens (NFTs) to enable universal support for royalty payments across all NFT marketplaces and ecosystem participants.

Impact

1. Loss of royalties for the protocol:
   No royalties are collected when FootiumClub nfts are bought/sold. As of this comment from the protocol designer, it is intended that the EIP2981 standard should be implemented into the FootiumClub contract, so that on club sale, royalties will be paid back to the protocol.

Code Snippet

https://github.com/sherlock-audit/2023-12-footium/blob/main/footium-eth-shareable/contracts/FootiumClub.sol#L14-L20

https://github.com/sherlock-audit/2023-12-footium/blob/main/footium-eth-shareable/contracts/FootiumPlayer.sol#L19

https://github.com/sherlock-audit/2023-12-footium/blob/main/footium-eth-shareable/contracts/FootiumPlayer.sol#L95-L100

Tool used

Manual Review

Recommendation

Consider implementing the EIP2981 standard into the FootiumClub contract similar to how it is implemented into the FootiumPlayer contract in order to avoid a loss of royalties for the protocol.

Duplicate of #68

[sherlock-admin2]

1 comment(s) were left on this issue during the judging contest.

darkart commented:

Even if team is sold the players are not directly connected to the team according to developers