Submitted by Trust, also found by Lambda
https://github.com/code-423n4/2022-12-tessera/blob/f37a11407da2af844bbfe868e1422e3665a5f8e4/src/seaport/modules/OptimisticListingSeaport.sol#L295 
https://github.com/code-423n4/2022-12-tessera/blob/f37a11407da2af844bbfe868e1422e3665a5f8e4/src/seaport/modules/OptimisticListingSeaport.sol#L232
In OptimisticListingOpensea, there are several functions which update pendingBalances of a proposer:
Unfortunately, in list() and cash() the = operator is used instead of += when writing the new pendingBalances. For example:
pendingBalances is not guaranteed to be zero. There could be funds from previous proposals which are not yet collected. Propose updates pendingBalance correctly:
So, when propose is followed by another propose(), the pendingBalance is updated correctly, but in cash and list we dont account for pre-existing balance. This issue would manifest even after the fix suggested in the issue User can send a proposal and instantly take back their collateral because reject functions would increment the pendingBalance and then it would be overriden.
User loses collateral converted to pendingBalance when cash() or list() is called.
Change the = operator to += in list() and cash().
mehtaculous (Tessera) confirmed and commented:
stevennevins (Tessera) mitigated:
