Bauchibred - Users can still bypass Player royalties on EIP2981 compatible markets by selling clubs as a whole

[sherlock-admin]

Bauchibred

medium

Users can still bypass Player royalties on EIP2981 compatible markets by selling clubs as a whole

Summary

Issue was originally submitted here being tagged as a "will fix" by protocol, but has not been fixed.

Vulnerability Detail

Take a look at FootiumPlayer.sol#L16-L23

contract FootiumPlayer is
    ERC721Upgradeable,
    AccessControlUpgradeable,
    ERC2981Upgradeable,
    PausableUpgradeable,
    ReentrancyGuardUpgradeable,
    OwnableUpgradeable
{

As seen FootiumPlayer implements the EIP2981 standard which creates fees when buy/selling the players.

Now take a look at FootiumClub.sol#L14-L20

contract FootiumClub is
    ERC721Upgradeable,
    AccessControlUpgradeable,
    PausableUpgradeable,
    ReentrancyGuardUpgradeable,
    OwnableUpgradeable
{

Evidently, FootiumClub never implements this standard.

Now from this comment by the protocol developers after the submission of the original issue, we can see that it's the right functionality for the club to also implement this EIP standard.

Impact

Refer to this report and it's duplicates on how this could be impactful, though the TLDR from the referenced report is that users can bypass fees on player sales by selling club instead, would be important to note that this affects market places too, cause the market places that support the ERC 2981, wont be able to pay royalties for any FootiumClub nfts.

Code Snippet

FootiumClub.sol#L14-L20

Tool used

Manual Review

Recommendation

Implement EIP2981 on clubs as well.

Duplicate of #68

[sherlock-admin2]

1 comment(s) were left on this issue during the judging contest.

darkart commented:

Even if team is sold the players are not directly connected to the team according to developers