Summary

Allowing users to only publish orders, but not to edit them might expose them to risk if the market conditions change.

Vulnerability Details

The protocol exposes a market-like functionality to list and buy ERC20s, which could later be exchanged to claim NFTs.

Each pieces owner, can list some or all of ERC20s in exchange for ETH. That order will remain on the market, until someone buys it. This period would be unknown and during that time few things can happen:

• The user might decide to collect the other pieces of the NFT and delist his offer.

• The price of the NFT, which the ERC20s are pegged to might increase significantly

During both situations, the seller won't have any option to delist or to change the sell order. His ERC20s will be stuck in the order, waiting for someone to take advantage.

Impact

High, as it poses a big risk on the ERC20s market functionality, which is core to the protocol

Tools Used

Manual review

Recommendations

Implement functionality to adjust/remove sell order.