The formula for calculating the `nukeFundContribution` when buying a nft in the `EntityTrading::buyNft` function is limited to a single value of `EntityTrading::taxCut`, resulting in a poor distribution of funds between the different parties.
Audit: 2024-07-traitforge-findings
Severity: HIGH

# Lines of code

https://github.com/code-423n4/2024-07-traitforge/blob/279b2887e3d38bc219a05d332cbcb0655b2dc644/contracts/EntityTrading/EntityTrading.sol#L72


# Vulnerability details

## Description

The `nukeFundContribution`  is 10% of the purchase price of the NFT for the moment according to the protocol documentation. However, if this early `taxCut` is modified using the `EntityTrading::setTaxCut` function, the formula currently used will no longer be valid..

In the calculations, instead of multiplying the amount of the purchase(the `msg.value`) by `EntityTrading::taxCut` state variable and then dividing by 100 to extract the `taxCut%`, we just divided by `taxCut`, which is ok now but will be wrong if `EntityTrading::taxCut` is different from 10.

```solidity
    function buyNFT(uint256 tokenId) external payable whenNotPaused nonReentrant {
    Listing memory listing = listings[listedTokenIds[tokenId]];
    require(
      msg.value == listing.price,
      "ETH sent does not match the listing price"
    );
    require(listing.seller != address(0), "NFT is not listed for sale.");

@>  uint256 nukeFundContribution = msg.value / taxCut;
    uint256 sellerProceeds = msg.value - nukeFundContribution;
    transferToNukeFund(nukeFundContribution); // transfer contribution to nukeFund

    // transfer NFT from contract to buyer
    (bool success, ) = payable(listing.seller).call{ value: sellerProceeds }(
      ""
    );
    require(success, "Failed to send to seller");
    nftContract.transferFrom(address(this), msg.sender, tokenId); // transfer NFT to the buyer

    delete listings[listedTokenIds[tokenId]]; // remove listing

    emit NFTSold(
      tokenId,
      listing.seller,
      msg.sender,
      msg.value,
      nukeFundContribution
    ); // emit an event for the sale
  }
```

## Impact

The `nukefund` receives more fund than expected under the protocol and the NFT seller receives less than expected; there is a loss of fund.

## Proof of Concept

When an NFT is buy, the protocol provides for a taxCut% contribution to the protocol through the `nukefund` and the remainder is transferred to the buyer. All this is written in the protocol documentation: https://github.com/TraitForge/docs/blob/main/README.md#trait-token

## Tools Used

Manual review.

## Recommended Mitigation Steps

Change the calculation formula as follows:

```diff
  function buyNFT(uint256 tokenId) external payable whenNotPaused nonReentrant {
    Listing memory listing = listings[listedTokenIds[tokenId]];
    require(
      msg.value == listing.price,
      "ETH sent does not match the listing price"
    );
    require(listing.seller != address(0), "NFT is not listed for sale.");

-   uint256 nukeFundContribution = msg.value / taxCut;
+   uint256 nukeFundContribution = (msg.value * taxCut) / 100;
    uint256 sellerProceeds = msg.value - nukeFundContribution;
    transferToNukeFund(nukeFundContribution); // transfer contribution to nukeFund

    // transfer NFT from contract