FERC1155 royalty should be limited to prevent potential underflows

[code423n4]

Lines of code

https://github.com/code-423n4/2022-07-fractional/blob/main/src/FERC1155.sol#L223

Vulnerability details

Impact

Generally, when accessing the contract's royalties, the caller will use the following schema:

uint amount = x;
(address receiver, uint royalty) = c.royaltyInfo(id, amount);
token.transfer(receiver, royalty);
token.transfer(owner, amount - royalty); // send remaining balance to the owner of the token.

If the royalty is larger than 100%, the last line will trigger an underflow.

Proof of Concept

https://github.com/code-423n4/2022-07-fractional/blob/main/src/FERC1155.sol#L223

Allows the controller to set whatever value they want.

Tools Used

none

Recommended Mitigation Steps

Use a reasonable limit, e.g. 10%

[0x0aa0]

Duplicate of #166