LooksRare Aggregator contest - tnevler's results

Report

Low Risk

[L-1]: Missing checks for address(0x0)

Context:

1. marketplace = ILooksRareExchange(_marketplace); L38
2. aggregator = _aggregator; L39
3. marketplace = SeaportInterface(_marketplace); L46
4. aggregator = _aggregator; L47
5. aggregator = ILooksRareAggregator(_aggregator); L22

Recommendation:

Add non-zero address checks when set address state variables.

Non-Critical Issues

[N-1]: Wrong order of functions

Context:

1. SeaportProxy.receive (receive function must be after constructor)
2. LooksRareAggregator.rescueERC721 (external function can not go after external view function)
3. LooksRareAggregator.receive (receive function must be after constructor and before all external functions)

Description:

According to official solidity documentation functions should be grouped according to their visibility and ordered:

• constructor

• receive function (if exists)

• fallback function (if exists)

• external

• public

• internal

• private

Within a grouping, place the view and pure functions last.

Recommendation:

Put the functions in the correct order according to the documentation.

[N-2]: NatSpec is missing

Context:

1. https://github.com/code-423n4/2022-11-looksrare/blob/main/contracts/libraries/OrderStructs.sol
2. https://github.com/code-423n4/2022-11-looksrare/blob/main/contracts/proxies/LooksRareProxy.sol#L107
3. https://github.com/code-423n4/2022-11-looksrare/blob/main/contracts/proxies/SeaportProxy.sol#L88
4. https://github.com/code-423n4/2022-11-looksrare/blob/main/contracts/proxies/SeaportProxy.sol#L136
5. https://github.com/code-423n4/2022-11-looksrare/blob/main/contracts/proxies/SeaportProxy.sol#L166
6. https://github.com/code-423n4/2022-11-looksrare/blob/main/contracts/proxies/SeaportProxy.sol#L178
7. https://github.com/code-423n4/2022-11-looksrare/blob/main/contracts/proxies/SeaportProxy.sol#L227
8. https://github.com/code-423n4/2022-11-looksrare/blob/main/contracts/ERC20EnabledLooksRareAggregator.sol#L39
9. https://github.com/code-423n4/2022-11-looksrare/blob/main/contracts/LooksRareAggregator.sol#L222
10. https://github.com/code-423n4/2022-11-looksrare/blob/main/contracts/LooksRareAggregator.sol#L241
11. https://github.com/code-423n4/2022-11-looksrare/blob/main/contracts/TokenReceiver.sol#L24
12. https://github.com/code-423n4/2022-11-looksrare/blob/main/contracts/TokenTransferrer.sol#L14

[N-3]: Line is too long

Context:

1. FulfillmentComponent[][] considerationFulfillments; // Contains the order and item index of each consideration item L27
2. bytes32 zoneHash; // An arbitrary 32-byte value that will be supplied to the zone when fulfilling restricted orders that the zone can utilize when making a determination on whether to authorize the order L35
3. bytes32 conduitKey; // A bytes32 value that indicates what conduit, if any, should be utilized as a source for token approvals when performing transfers L37
4. * @notice This contract offers transfer of ownership in two steps with potential owner having to confirm the transaction. L8
5. * Renouncement of the ownership is also a two-step process with a timelock since the next potential owner is address(0). L9
6. * @notice This contract is used to verify signatures for EOAs (with length of both 65 and 64 bytes) and contracts (ERC-1271). L9
7. * @notice Return ETH to the original sender if any is left in the payable call but leave 1 wei of ETH in the contract. L52

Description:

Maximum suggested line length is 120 characters.

Report

Gas Optimizations

[G-1]: Use calldata instead of memory

Context:

1. OrderTypes.TakerOrder memory takerBid, L108
2. OrderTypes.MakerOrder memory makerAsk, L109
3. function _populateParameters(BasicOrder calldata order, OrderExtraData memory orderExtraData) L227 (orderExtraData)
4. function _splitSignature(bytes memory signature) L19
5. function _recoverEOASigner(bytes32 hash, bytes memory signature) internal pure returns (address signer) { L56
6. bytes memory signature L75

Description:

If a reference type function parameter is read-only, it is recommended to use calldata instead of memory because this provides significant gas savings. Since Solidity v0.6.9, memory and calldata are allowed in all functions regardless of their visibility type (ie external, public, etc).