Malicious group of sellers may fill up all the slots for listings targeting a buyer in a given round.
Summary / Description
The protocol allows for serial listing targetting a buyer without the buyer approving it. The only requirement is a royaty fee to get in and that's it. This may give rise to behavior such as a malicious group of degen sellers that fill up all the slots for listings targetting a buyer in a given round.
Impact
The buyer does not benefit because there is a group attacking him/her start of every round.
Tools Used
Manual Analysis
Recommended Mitigations
Use a 2 phase opt in.
Phase 1 - A reputed seller offers to pay royalty.
Phase 2 - Buyer approves of him in the BUY phase
Now they can both participate. This gives buyer time to research about the seller (maybe do some online research with their ENS find stuff about them like their reputation on Cyfrin Profiles, etc, before getting in business with them)
Once it's confirmed to the buyer that the seller is someone they want service from, they can be added to the list.
Lead Judging Commences
DOS the buyer / Lack of minimal amount of listing price
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.