Locker.sol

The Locker holds each of the deposited NFTs and is responsible for minting and burning the collection tokens that are backed by them. We found no path that mints a collection token without an NFT being deposited, and no path that removes an NFT without burning one token-equivalent. The isListing protection is correctly applied to redeem, swap, swapBatch, withdrawToken and the airdrop claim validation.

There are no issues specific to just Locker.sol, but there are two behaviours of the Locker that contribute to issues raised elsewhere in this audit:

1. addListings will register a second Listings contract without validating that it is safe to run alongside the first. This is covered in Listings.sol.
2. deposit and redeem have no awareness of an active shutdown, which allows the collection token supply to be inflated and unwound inside a single transaction. This is covered in CollectionShutdown.sol.

It should also be noted that removeListings will remove the listing protection from every open listing on the contract that is removed. This is documented as a destructive, owner only action, but the recovery path for the Listings.sol issue depends upon it. In our tests, a 5x listing on the removed contract was redeemed from the Locker for a single collection token during that window.