# \[DAO: QmNVXwN\] Security audit for collections royalties marketplaces

**URL:** <https://forum.decentraland.org/t/dao-qmnvxwn-security-audit-for-collections-royalties-marketplaces/2898>\
**Category:** Governance\
**Created:** [November 13, 2021, 11:15pm UTC](https://forum.decentraland.org/t/dao-qmnvxwn-security-audit-for-collections-royalties-marketplaces/2898 "2021-11-13T23:15:05Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dao](https://dub1.discourse-cdn.com/flex013/user_avatar/forum.decentraland.org/dao/32/386_2.png) [@dao](https://forum.decentraland.org/u/dao)\
**Post date:** [November 13, 2021, 11:15pm UTC](https://forum.decentraland.org/t/dao-qmnvxwn-security-audit-for-collections-royalties-marketplaces/2898/1 "2021-11-13T23:15:05Z")

</div>

> by 0x87956abc4078a0cc3b89b419928b857b8af826ed (Nacho)

Should the following Tier 4: up to $60,000 USD, 6 months vesting (1 month cliff) grant in the Platform Contributor category be approved?

## Abstract

Support royalties for Decentraland collections on secondary sales.

## Grant size

30,000 USD

## Beneficiary address

0xBCAc4dafB7e215f2F6cb3312aF6D5e4F9d9E7eDA

## Description

Based on the proposal passed [here](https://governance.decentraland.org/proposal/?id=b70c59d0-09c5-11ec-a4d1-8d5d2cba0825) + some free time I took the chance to upgrade the implementation of the Marketplace & Bid smart contracts to include royalties for collection creators/item beneficiaries. It is **ONLY IN POLYGON** where UG collections are being created.

For the time being, royalties are going to be calculated following:

- Each token is an item kind. You may know that each item can have a beneficiary which is used for primary sales. If the item has a beneficiary, the royalties will go to the item’s beneficiary. If not.
- Royalties will go to the collection creator.

The implementation of how the royalties receiver is calculated can be easily replaced by a new one. To understand how it can be done if you are tech, refer [here](https://github.com/decentraland/marketplace-contracts/blob/feat/marketplace-with-royalties/contracts/managers/RoyaltiesManager.sol)

The royalty will be 2.5%.

The smart contracts still support the current fee for the DAO but is going to be 0%. I decided to keep it if for some reason we need to have something like 1% for the DAO and 1.5% for creators.

The Grant amount can change. I’ve set a cap. I’m still waiting for the auditors’ quote.

## Specification

The smart contracts are ready for being audited.

Both implementations are [here for the marketplace](https://github.com/decentraland/marketplace-contracts/pull/56) and [here for bids](https://github.com/decentraland/bid-contract/pull/2)

The plan is to start testing the smart contracts within the Decentraland Marketplace ASAP. Once we can be sure that everything is working as expected and safe, launch it.

## Personnel

[@Nacho](https://github.com/nachomazzara): Decentraland Evangelist

## Roadmap and milestones

The roadmap for adding the royalties in the Decentraland Marketplace will be:

- Audit the smart contracts
- Deploy them in the Mumbai testnet.
- Integrate the new smart contracts in the subgraphs & in the UI.
- Deploy in Polygon.
- Launch

Related to the topic for this Grant. The roadmap is just to pay for the audit of the smart contracts.

For integrating the smart contract in the Decentraland Marketplace I will require effort for the engineer team.

**[Vote on this proposal on the Decentraland DAO](https://governance.decentraland.org/proposal/?id=7b6692e0-44d7-11ec-be0c-afec86cba5e5)**

**[View this proposal on Snapshot](https://snapshot.org/#/snapshot.dcl.eth/proposal/QmNVXwNJUjLb4pRA6Qm7uXARVbifuJW7td5bpvjC92wxTr)**

---

<div class="post-metadata">

**Author:** ![dao](https://dub1.discourse-cdn.com/flex013/user_avatar/forum.decentraland.org/dao/32/386_2.png) [@dao](https://forum.decentraland.org/u/dao)\
**Post date:** [August 9, 2022, 1:58pm UTC](https://forum.decentraland.org/t/dao-qmnvxwn-security-audit-for-collections-royalties-marketplaces/2898/2 "2022-08-09T13:58:33Z")

</div>

Security audit for collections royalties marketplaces

This proposal has been ENACTED by a DAO Committee Member (0xfe91c0c482e09600f2d1dbca10fd705bc6de60bc)

Vesting Contract not created. Paid directly to address 0x7C6Eda316FC4aBf1efaBA8015e6Ff04B241fcb35 in USDT.

[View Transaction](https://etherscan.io/tx/0x805f395630fbdbe319ac184b9354eab42f5b7ffd35a362c40ffba7a8cbe1cc32)

Pessimistic audit 6k

- [TX 1](https://etherscan.io/tx/0xd1f2b8374f710850963d4322b7c44a3f1f455ff50e870ac7e47734c6d4f94124)
- [TX 2](https://etherscan.io/tx/0xa8d45c86e7b34f9c32ade7411782e4cea17ac8e45527038cb65a0d3878666f33)
- [Report 1](https://hackmd.io/@pessimistic/B1gZ-ZR9t) and [Report 2](https://hackmd.io/@pessimistic/rk_31kcst)

Certik audit 24k:

- [TX 1](https://etherscan.io/tx/0x29bad8ce30296214ded7cb97b7b2ac96a6b88ecca7b10864722ca0301332fc13)
- [TX 2](https://etherscan.io/tx/0xe17735284486da39c81e7e2650831c4014d7a30cf290e5e44761d8fecbd42f2d)
- [Report](https://github.com/decentraland/smart-contract-audits/blob/master/reports/Decentraland_Marketplace_and_Bids_V2_With_Royalties_Certik_12_03_2021.pdf)