Foundation contest - jayjonah8's results

This seems like a 1 (Low Risk) issue.

• Only impacts calls reserved for use by Foundation admins.
• Does not lead to abuse:
  • If nftContracts is larger than the function reverts as expected (with an index out of bounds error).
  • If tokenIds is larger than the additional data is simply ignored.

The latter is an indication of user error and we agree reverting is better than processing a request that may not align with the caller's full expectations. We will add the recommended require statement to this call.

Assets not at risk, function not at risk. Severity 1 is correct.

@NickCuso, have you considered using an array of structs instead of two arrays?

struct CancelOffer {
    address nftContract;
    uint256 tokenId;
}

function adminCancelOffers(
    CancelOffer[] calldata cancelOffers,
    string calldata reason
)

Yes - we originally did not go that route because of poor support on etherscan and defender, but I believe both have been updated to support structs better now. It would be good to revisit patterns like this again.

Since this issue was downgraded to a QA level, and the warden did not submit a separate QA report, we've renamed this one to "QA report" for consistency.

The original title, for the record, was "no check that array length arguments are the same."

This would be a QA Score of 10 by my metrics.