Erc1155RewardMinterFacetStorage Manual Review Findings

ERG-01M: Improper Configuration of Required Packets

Type	Severity	Location
Logical Fault		Erc1155RewardMinterFacetStorage.sol:L155

Description:

The Erc1155RewardMinterFacetStorage::setCampaignTransferRewards function will improperly configure the amountPerPacket required by a particular EIP-1155 asset as it creates a token-to-amount association rather than a token-to-ID-to-amount association, overwriting previously configured packet amounts required by the latest ones defined to the system.

Impact:

A campaign with the same EIP-1155 asset and multiple IDs of it will be unable to configure distinct amounts per packet for each token ID instead utilizing the latest configured one for all token IDs.

Example:

Copy
138RewardPacket storage campaignPacketInfo = l.campaignsPacketInfo[campaignId];
139
140campaignPacketInfo.tokenIds = tokenIds_;
141campaignPacketInfo.tokenAddresses = new address[](length);
142
143for (uint256 i = 0; i < length; i++) {
144    address tokenAddress = tokenAddresses_[i];
145    uint256 amountPerPacket = amountOfTokensPerPacket_[i];
146
147    if (tokenAddress == address(0)) {
148        revert InvalidZeroRewardPacketAddressData(campaignId, i);
149    }
150    if (amountPerPacket == 0) {
151        revert InvalidZeroRewardPacketAmountData(campaignId, i);
152    }
153
154    campaignPacketInfo.tokenAddresses[i] = tokenAddress;
155    campaignPacketInfo.amountOfTokensPerPacket[tokenAddress] = amountPerPacket;
156}

Recommendation:

We advise the code to properly retain a distinct entry per token and per token ID, ensuring that multiple IDs under the same EIP-1155 asset can have varying amounts required per packet which is a canonical use-case scenario of a staking system.

To note, care should be taken to avoid similar albeit less severe complications outlined in the EIP-20 reward configuration function in relation to duplicate entries.

Alleviation (b64b659786cf3c84bea52feb3a69f546ba3601f0):

The mapping relation was updated to support a token to NFT ID to packet association as expected, alleviating this exhibit in full.