CoreCollection.initialize() Can Be Called Multiple Times

[code423n4]

Lines of code

https://github.com/code-423n4/2022-03-joyn/blob/c9297ccd925ebb2c44dbc6eaa3effd8db5d2368a/core-contracts/contracts/CoreCollection.sol#L78-L97

Vulnerability details

Impact

The function CoreCollection.initialize() may be called multiple times. This is a function only intended to be called once during startup.

As a result the owner can change variables such as mintFee (which could be used to catch unaware users to transfer more tokens than they intended during a mintTokencall),_maxSupply, payableToken, isForSaleandsplitFactorymay be changed in addition to the_name, _symbolandBaseUri`.

Proof of Concept

There are no restrictions to this function being called multiple times.

    function initialize(
        string memory _collectionName,
        string memory _collectionSymbol,
        string memory _collectionURI,
        uint256 _maxSupply,
        uint256 _mintFee,
        address _payableToken,
        bool _isForSale,
        address _splitFactory
    ) external onlyOwner onlyValidSupply(_maxSupply) {
        _name = _collectionName;
        _symbol = _collectionSymbol;
        _baseUri = _collectionURI;
        maxSupply = _maxSupply;
        mintFee = _mintFee;
        payableToken = IERC20(_payableToken);
        isForSale = _isForSale;
        splitFactory = _splitFactory;
        initialized = true;
    }

Recommended Mitigation Steps

This issue may be mitigated by calling require(!initialized); at the beginning of initialize().

[sofianeOuafir]

In my opinion, the severity level should be 3 (High Risk) instead of 2 (Med Risk)

duplicate of #4