QA Report #163
Labels
bug
Something isn't working
QA (Quality Assurance)
Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax
In the lines (https://github.com/code-423n4/2022-05-opensea-seaport/blob/main/contracts/conduit/Conduit.sol#L2, https://github.com/code-423n4/2022-05-opensea-seaport/blob/main/contracts/lib/TokenTransferrer.sol#L2), there’s a floating Pragma. Contracts should be deployed with the same compiler version and flags that they have been tested with to avoid using an outdated compiler version that might introduce bugs.
In the function createConduit (https://github.com/code-423n4/2022-05-opensea-seaport/blob/4140473b1f85d0df602548ad260b1739ddd734a5/contracts/conduit/ConduitController.sol#L57) the user can create a conduit with any address as its owner, as there is no checks when it comes to the initialOwner variable. While this could be intended, in the function transferOwnership (https://github.com/code-423n4/2022-05-opensea-seaport/blob/4140473b1f85d0df602548ad260b1739ddd734a5/contracts/conduit/ConduitController.sol#L189) there is a check to prevent the conduit to be transferred to address 0, and after transferOwnership is called, the address used as newPotentialOwner needs to call the function acceptOwnership, which does not happen in the createConduit function so a user could create a conduit with anyone as the owner, bypassing both a 0 address check and the process of transfer.
(https://github.com/code-423n4/2022-05-opensea-seaport/blob/main/contracts/conduit/Conduit.sol#L175)
This comment is describing the wrong behavior and probably a remnant of an old version of the code, while the comment is talking about native tokens and Ether, code below is about ERC20s.
The text was updated successfully, but these errors were encountered: