Submitted by Lambda, also found by Trust
In OptimisticListingSeaport.propose, pendingBalances is set to the collateral. The purpose of this is that the proposer of a previous proposal can withdraw his collateral afterwards. However, this is done on the storage variable proposedListing after the new listing is already set:
Because of that, it will actually set pendingBalances of the new proposer. Therefore, the old proposer loses his collateral and the new one can make proposals for free.
This test fails and optimistic.pendingBalances(vault, bob) is equal to _collateral.
Run pendingBalances[_vault][proposedListing.proposer] += proposedListing.collateral; before the _setListing call, in which case the above PoC no longer works.
HickupHH3 (judge) commented:
mehtaculous (Tessera) confirmed and commented:
stevennevins (Tessera) mitigated:
