Submitted by cccz, also found by IllIllI and minhquanym
An attacker can create a short put option on cryptopunk. When the user fulfills the order, the baseAsset will be transferred to the contract. 
However, since cryptopunk does not support ERC721, the user cannot exercise the option because the safeTransferFrom function call fails. Attacker can get premium and get back baseAsset after option expires.
https://github.com/code-423n4/2022-06-putty/blob/3b6b844bc39e897bd0bbb69897f2deff12dc3893/contracts/src/PuttyV2.sol#L343-L346
https://github.com/code-423n4/2022-06-putty/blob/3b6b844bc39e897bd0bbb69897f2deff12dc3893/contracts/src/PuttyV2.sol#L628-L629
Consider adding a whitelist to nfts in the order, or consider supporting exercising on cryptopunk.
STYJ (warden) commented:
thereksfour (warden) commented:
STYJ (warden) commented:
outdoteth (Putty Finance) acknowledged, but disagreed with severity and commented:
HickupHH3 (judge) decreased severity to Medium and commented:
hyh (warden) reviewed mitigation:
