QA Report

[code423n4]

1) Floating Pragma

In the lines (https://github.com/code-423n4/2022-05-opensea-seaport/blob/main/contracts/conduit/Conduit.sol#L2, https://github.com/code-423n4/2022-05-opensea-seaport/blob/main/contracts/lib/TokenTransferrer.sol#L2), there’s a floating Pragma. Contracts should be deployed with the same compiler version and flags that they have been tested with to avoid using an outdated compiler version that might introduce bugs.

2) No 0 address check for initialOwner, as well as user being able to create a conduit with anyone as the owner

In the function createConduit (https://github.com/code-423n4/2022-05-opensea-seaport/blob/4140473b1f85d0df602548ad260b1739ddd734a5/contracts/conduit/ConduitController.sol#L57) the user can create a conduit with any address as its owner, as there is no checks when it comes to the initialOwner variable. While this could be intended, in the function transferOwnership (https://github.com/code-423n4/2022-05-opensea-seaport/blob/4140473b1f85d0df602548ad260b1739ddd734a5/contracts/conduit/ConduitController.sol#L189) there is a check to prevent the conduit to be transferred to address 0, and after transferOwnership is called, the address used as newPotentialOwner needs to call the function acceptOwnership, which does not happen in the createConduit function so a user could create a conduit with anyone as the owner, bypassing both a 0 address check and the process of transfer.

3) Typo

(https://github.com/code-423n4/2022-05-opensea-seaport/blob/main/contracts/conduit/Conduit.sol#L175) This comment is describing the wrong behavior and probably a remnant of an old version of the code, while the comment is talking about native tokens and Ether, code below is about ERC20s.

[FlameHorizon5]

the second issue in this report is the same as the one in report #65, which was validated unlike this one, i'd like it if it was reviewed and if it was explained what the difference between them is

[GalloDaSballo]

Disagree with Floating pragma per discussion in #67

No check -> Valid Low as Dup of #65 Typo -> Valid NC

1 L, 1 NC

[GalloDaSballo]

Updated per discussion on #67

1L, 2NC