OpenSea Seaport 1.2 contest - chaduke's results

A marketplace protocol for safely and efficiently buying and selling NFTs.

General Information

Platform: Code4rena

Start Date: 13/01/2023

Pot Size: $100,500 USDC

Total HM: 1

Participants: 23

Period: 10 days

Judge: hickuphh3

Total Solo HM: 1

Id: 201

League: ETH

OpenSea

Findings Distribution

Researcher Performance

Rank: 18/23

Findings: 1

Award: $140.67

QA:
grade-b

🌟 Selected for report: 0

🚀 Solo Findings: 0

Findings Information

Awards

140.6728 USDC - $140.67

Labels

bug
grade-b
QA (Quality Assurance)
edited-by-warden
Q-11

External Links

QA1. https://github.com/ProjectOpenSea/seaport/blob/5de7302bc773d9821ba4759e47fc981680911ea0/contracts/lib/OrderValidator.sol#L890 It might be better to change the original name doesNotSupportPartialFills to _attemptToFillPartialOnFull() since the former only reflects to check whether it is a full order, not the violation itself.

QA2. https://github.com/ProjectOpenSea/seaport/blob/5de7302bc773d9821ba4759e47fc981680911ea0/contracts/conduit/Conduit.sol#L202 We should emit the old status here as well.

QA3. https://github.com/ProjectOpenSea/seaport/blob/5de7302bc773d9821ba4759e47fc981680911ea0/contracts/conduit/ConduitController.sol#L124-L128 We should emit an event here to indicate the change of status.

QA4. https://github.com/ProjectOpenSea/seaport/blob/5de7302bc773d9821ba4759e47fc981680911ea0/contracts/conduit/ConduitController.sol#L436 We can add a check here to ensure the index is correct:

if(_conduits[conduit].channelIndexesPlusOne[channel] != channelIndex+1){ revert ChannelOutOfRange(conduit); }

QA5. https://github.com/ProjectOpenSea/seaport/blob/5de7302bc773d9821ba4759e47fc981680911ea0/contracts/conduit/ConduitController.sol#L308-L318 call _assertConduitExists(conduit); first at the beginning of the function getKey().

QA6. https://github.com/ProjectOpenSea/seaport/blob/5de7302bc773d9821ba4759e47fc981680911ea0/contracts/conduit/ConduitController.sol#L202-L224 Check whether the newPoentialOwner is already the owner:

if (newPotentialOwner == msg.sender) { // we know the caller is the owner due to previous check revert NewPotentialOwnerIsAlreadyOwner(conduit); }

#0 - HickupHH3

2023-01-25T09:31:44Z

QA1: R
 QA2,3: 1NC 
QA4: NC
 
QA5: NC 

QA6: R

#1 - c4-judge

2023-01-25T09:31:49Z

HickupHH3 marked the issue as grade-b

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter