OpenSea Seaport contest - foobar's results

A marketplace contract for safely and efficiently creating and fulfilling orders for ERC721 and ERC1155 items.

General Information

Platform: Code4rena

Start Date: 20/05/2022

Pot Size: $1,000,000 USDC

Total HM: 4

Participants: 59

Period: 14 days

Judge: leastwood

Id: 128

League: ETH

OpenSea

Findings Distribution

Researcher Performance

Rank: 26/59

Findings: 2

Award: $2,329.87

🌟 Selected for report: 0

🚀 Solo Findings: 0

Awards

1895.6044 USDC - $1,895.60

Labels

bug
QA (Quality Assurance)

External Links

  1. ConduitController uses a two-step ownership transfer process, which is good design. However, I'd recommend renaming the initial transferOwnership() method to offerOwnership() to avoid confusion with OpenZeppelin's Ownable.transferOwnership() method, which has the same name but is an atomic transfer that requires no acceptance.

https://github.com/code-423n4/2022-05-opensea-seaport/blob/9d7ce4d08bf3c3010304a0476a785c70c0e90ae7/contracts/conduit/ConduitController.sol#L189

  1. Checks for invalid addresses are unnecessary in transferOwnership() because an invalid address cannot accept ownership. You can remove the check on lines 196-199 and remove the funciton cancelOwnershipTransfer() altogether, letting people call transferOwnership(conduit, address(0x0)) for cancelling functionality instead.

https://github.com/code-423n4/2022-05-opensea-seaport/blob/9d7ce4d08bf3c3010304a0476a785c70c0e90ae7/contracts/conduit/ConduitController.sol#L196-L199

#0 - GalloDaSballo

2022-07-17T16:24:52Z

1 Valid NC from #207

#1 - GalloDaSballo

2022-07-17T18:11:48Z

Also, given the context of the codebase, agree with refactoring (no need to check for address(0)) as the address(0) cannot accept ownership.

#2 - GalloDaSballo

2022-07-17T18:11:54Z

1 R, 1NC

Tiniest suggestion ever: change a postfix decrement to a prefix decrement. Get your 2 units of gas back!

https://github.com/code-423n4/2022-05-opensea-seaport/blob/main/contracts/lib/OrderCombiner.sol#L229

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter