Submitted by Soosh, also found by 0x1f8b, 0x4non, 0xc0ffEE, arcoun, cccz, d3e4, minhtrng, RaymondFam, rotcivegaf, Ruhum, RustyRabbit, saian, sakshamguruji, and Trust
ExecutionDelegate.sol#L119
To use the protocol (buy/sell NFTs), users must approve the ExecutionDelegate to handle transfers for their ERC721, ERC1155, or ERC20 tokens.
The safety mechanisms mentioned by the protocol do not protect users at all if the projects owner decides to rugpull.
From the contest page, Safety Features:
The owner can set approvedContract  to any address at any time with approveContract(address _contract), and revokeApproval() can be frontrun. As a result, all user funds approved to the ExecutionDelegate contract can be lost via rugpull.
While rug-pulling may not be the projects intention, I find that this is still an inherently dangerous design.
I am unsure about the validity of centralization risk findings on C4, but I argue this is a valid High risk issue as:
This is due to an insecure design of the protocol. So as far as recommendations go, the team should reconsider the protocols design.
I do not think ExecutionDelegate should be used. It would be better if BlurExchange.sol is approved by users instead. The exchange should require that the buyer has received their NFT and the seller has received their ETH/WETH or revert.
Alex the Entreprenerd (Judge) decreased severity and commented:
Alex the Entreprenerd (Judge) increased severity to Medium and commented:
For this contest, 24 reports were submitted by wardens detailing low risk and non-critical issues. The report highlighted below by 0x4non received the top score from the judge.
The following wardens also submitted reports: 0x1f8b, 0xNazgul, 0xSmartContract, arcoun, bin2chen, zzykxx, brgltd, csanuragjain, d3e4, Deivitto, Trust, enckrish, exd0tpy, IllIllI, ladboy233, Lambda, simon135, nicobevi, RaymondFam, rbserver, Rolezn, rotcivegaf, and RustyRabbit.
