# Artist signatures can be forged to impersonate the artist behind a collection

NextGen setCollectionData lacks a check that totalSupply > 0, letting a collection admin set a fake artist, sign, then swap in a real artist to forge signatures.

- Payout: Contest reward
- Severity: medium
- Program: NextGen
- Credited: The\_Kakers
- Disclosed: 2024-01-08
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-10-nextgen-findings/issues/741
- Library page: https://bugbountylibrary.com/r/c4%3A2023-10-nextgen%3AM-06
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** NextGenCore.setCollectionData / artistSignature
**Root cause:** setCollectionData only requires collectionTotalSupply <= 1e10 and does not require it to be > 0, so it can be called repeatedly while supply is zero. artistSignature can be called by the current artist address, and once set neither the signature nor artist address can be changed.
**Steps:**
1. Collection admin calls `setCollectionData(collectionId, fakeArtist, maxPurchases, 0, timeAfterMint)` with zero supply.
2. Admin (as fakeArtist) calls `artistSignature(collectionId, "I am the Legit Artist...")`.
3. Admin calls `setCollectionData(collectionId, legitArtist, maxPurchases, 1000, timeAfterMint)` again with real supply.
4. Result: `retrieveArtistAddress(collectionId) == legitArtist` while `artistsSignatures(collectionId)` holds the fake signature.
**How found:** Reading setCollectionData's require conditions and noticing collectionTotalSupply is only upper-bounded, not required to be non-zero, allowing repeated calls before supply is set; combined with artistSignature being callable by the current artist address and immutable once set.
**Exploitation:** A collection admin sets a fake artist address while total supply is zero, signs an arbitrary message as that fake artist, then re-initializes the collection with the legitimate artist's address and real supply. The collection appears signed by the real artist, and the signature/artist address can no longer be changed.
**Insight:** When a setter is gated on a state value being zero (e.g. totalSupply == 0), check whether the setter itself can re-set that value to zero or leave it zero, enabling repeated re-initialization between privileged actions.