Bug: Updating the metadata can lead to creator-less cNFTs

[c4b4d4]

When updating the metadata of a cNFT if none of the creators are verified you can pass an empty Vec and the transaction can go thru. Unless I’m missing something.

There is no check for empty creators Vec when updating the metadata.

mpl-bubblegum/programs/bubblegum/program/src/processor/update_metadata.rs

Line 143 in ec267f6

let no_new_creators_verified = all_verified_creators_in_a_are_in_b(

[danenbm]

I think you saw the responses in the dev TG, but just for reference wanted to post it here that it was intentional to allow creatorless cNFTs. I believe it was considered to broaden the use cases of bubblegum to things like gaming where creators/royalties might not be applicable. As such it is checked in assert_metadata_is_mpl_compatible() and if there are creators, the number of creators must be enforced, no duplicates, and total percentage is 100%. Empty creator array for Bubblegum is handled in DAS, and it is inconsistent with TM.

I also added some explicit tests for the empty creator array as that is important logic you highlighted: #100