Submitted by V_B, also found by Decurity, hyh, carrotsmuggler, vv7, teawaterwire, M0ndoHEHE, hanxin, HE1M, rbserver, R2, zaskoh, Vadis, koxuan, Koolex, aviggiano, chaduke, and Rolezn
https://github.com/code-423n4/2022-11-looksrare/blob/main/contracts/TokenRescuer.sol#L22
https://github.com/code-423n4/2022-11-looksrare/blob/main/contracts/TokenRescuer.sol#L34
https://github.com/code-423n4/2022-11-looksrare/blob/main/contracts/LooksRareAggregator.sol#L27
https://github.com/code-423n4/2022-11-looksrare/blob/main/contracts/LooksRareAggregator.sol#L108
https://github.com/code-423n4/2022-11-looksrare/blob/main/contracts/LooksRareAggregator.sol#L109
https://github.com/code-423n4/2022-11-looksrare/blob/main/contracts/LooksRareAggregator.sol#L245
https://github.com/code-423n4/2022-11-looksrare/blob/main/contracts/lowLevelCallers/LowLevelETH.sol#L43
The LooksRareAggregator smart contract implements a bunch of functions to escape funds by the contract owner (see rescueETH, rescueERC20, rescueERC721, and rescueERC1155). In this way, any funds that were accidentally sent to the contract or were locked due to incorrect contract implementation can be returned to the owner. However, locked funds can be rescued by anyone without the owners permission. This is completely contrary to the idea of having rescue functions.
In order to withdraw funds from the contract, a user may just call the execute function in the ERC20EnabledLooksRareAggregator with tokenTransfers that contains the addresses of tokens to be withdrawn. 
Thus, after the order execution _returnERC20TokensIfAny and _returnETHIfAny will be called, and the whole balance of provided ERC20 tokens and Ether will be returned to msg.sender.
Please note, that means that the owner can be front-ran with rescue functions and an attacker will receive funds instead.
Useless of rescue functionality and vulnerability to jamming funds.
_returnETHIfAny and _returnERC20TokensIfAny should return the amount of the token that was deposited.
Picodes (judge) decreased severity to Medium and commented:
0xhiroshi (LooksRare) disputed and commented:
Picodes (judge) commented:
For this contest, 53 reports were submitted by wardens detailing low risk and non-critical issues. The report highlighted below by RaymondFam received the top score from the judge.
The following wardens also submitted reports: V_B,
adriro,
ajtra,
Josiah,
horsefacts,
Chom,
fs0c,
rbserver,
tnevler,
Waze,
ch0bu,
brgltd,
jayphbee,
a12jmx,
0xc0ffEE,
bearonbike,
delfin454000,
pashov,
carrotsmuggler,
ret2basic,
Deivitto,
0xhacksmithh,
0xSmartContract,
Sathish9098,
IllIllI,
SinceJuly,
carlitox477,
R2,
Awesome,
erictee,
ReyAdmirado,
Rolezn,
Vadis,
Hashlock,
ktg,
zaskoh,
0x52,
ladboy233,
cccz,
Nyx,
Bnke0x0,
BClabs,
SamGMK,
KingNFT,
perseverancesuccess,
fatherOfBlocks,
aphak5010,
datapunk,
bin,
0x1f8b,
8olidity, and
chaduke
.
