OpenSea Seaport contest - cccz's results

[Low-01]Missing 0 address check

Impact

Missing 0 address check when setting address in contracts.

Proof of Concept

https://github.com/code-423n4/2022-05-opensea-seaport/blob/4140473b1f85d0df602548ad260b1739ddd734a5/contracts/conduit/ConduitController.sol#L57-L94 https://github.com/code-423n4/2022-05-opensea-seaport/blob/4140473b1f85d0df602548ad260b1739ddd734a5/contracts/conduit/ConduitController.sol#L118-L127

Tools Used

None

Recommended Mitigation Steps

Add 0 address check

[G-01] OrderValidator: orderStatus.isCancelled = false can be omitted

Impact

The _verifyOrderStatus function will be called before _orderStatus[orderHash].isCancelled is set to false. Since the _verifyOrderStatus function requires isCancelled to be false, _orderStatus[orderHash].isCancelled = fasle can be omitted.

  function _verifyOrderStatus(
      bytes32 orderHash,
      OrderStatus memory orderStatus,
      bool onlyAllowUnused,
      bool revertOnInvalid
  ) internal pure returns (bool valid) {
      // Ensure that the order has not been cancelled.
      if (orderStatus.isCancelled) {
          // Only revert if revertOnInvalid has been supplied as true.
          if (revertOnInvalid) {
              revert OrderIsCancelled(orderHash);
          }

          // Return false as the order status is invalid.
          return false;
      }

Proof of Concept

https://github.com/code-423n4/2022-05-opensea-seaport/blob/4140473b1f85d0df602548ad260b1739ddd734a5/contracts/lib/OrderValidator.sol#L71-L72 https://github.com/code-423n4/2022-05-opensea-seaport/blob/4140473b1f85d0df602548ad260b1739ddd734a5/contracts/lib/OrderValidator.sol#L227-L228 https://github.com/code-423n4/2022-05-opensea-seaport/blob/4140473b1f85d0df602548ad260b1739ddd734a5/contracts/lib/OrderValidator.sol#L236-L237