Submitted by ronnyx2017, also found by 0x52
https://github.com/code-423n4/2022-11-looksrare/blob/main/contracts/proxies/SeaportProxy.sol#L136-L164
https://github.com/code-423n4/2022-11-looksrare/blob/main/contracts/proxies/SeaportProxy.sol#L232-L252
The order.price in the parameter tradeData is not used as the actual token amount sent to the seaport market and also not checked if those are equal when using the ERC20EnabledLooksRareAggregator for SeaportPorxy with ERC20 tokens.
So users can set the order.price to ZERO to avoid paying any fees for ERC20 orders.
Test file SeaportUSDCZeroPrice.t.sol, modified from test SeaportProxyERC721USDC.t.sol and annotate with # diff.
run test:
Foundry
Assert the order price is equal to the token amount of the seaport order when populating parameters.
0xhiroshi (LooksRare) confirmed, but disagreed with severity and commented:
0xhiroshi (LooksRare) commented:
Picodes (judge) decreased severity to Medium and commented:
