Submitted by leastwood
NFTMarketOffer.sol#L255-L271
NFTMarketReserveAuction.sol#L557
NFTMarketReserveAuction.sol#L510-L515
NFTMarketFees.sol#L188-L189
Once an auction has ended, the highest bidder now has sole rights to the underlying NFT. By finalizing the auction, fees are charged on the sale and the NFT is transferred to auction.bidder. However, if auction.bidder accepts an offer before finalization, fees will be charged on the auction.bidder sale before the original sale. As a result, it is possible to avoid paying the primary foundation fee as a creator if the NFT is sold by auction.bidder before finalization.
Consider the following scenario:
Ensure the _nftContractToTokenIdToFirstSaleCompleted is correctly tracked. It might be useful to ensure the distribution of funds are in the order of when the trades occurred. For example, an unfinalized auction should always have its fees paid before other sales.
NickCuso (Foundation) confirmed and commented:
For this contest, 20 reports were submitted by wardens detailing low risk and non-critical issues. The report highlighted below by leastwood received the top score from the judge.
The following wardens also submitted reports: 0xliumin, defsec, hubble, Dravee, csanuragjain, kenta, rfa, IllIllI, gzeon, 0xwags, cmichel, robee, CertoraInc, kirk-baird, 0x1f8b, Ruhum, TerrierLover, jayjonah8, and WatchPug.
