Frontrunning Private Trades Vulnerability

Lines of code Vulnerability details Impact The inability to create private trades in the Seaport contract would affect users significantly. Users will be forced to create public trades that run the risk of being frontrun. Proof of Concept Today, all trades are private meant for specific offerer a...

Compromised Channel Can Compromise ALL NFTs and Tokens

Lines of code Vulnerability details Impact The contest IN SCOPE section clearly states that offer items can only be transferred by a conduit that only has Seaport set as a channel. However, this condition is not true. If a compromised channel is added to a conduit, then ALL the NFTs and tokens th...

Order Overflow

Lines of code Vulnerability details Impact In the partial fill orderStatus calculation, there could be an overflow in the numerator and denominator calculation. This overflow could lead a buyer to buy more NFT/Other tokens than order amount. First example of impact: An NFT seller has two orders:...

U.S. Dept Of Defense: Unprotected ██████ and Test site API Exposes Documents, Credentials, and Emails in ██████████ Proposal System

Summary: The test/integration API of the █████ web services is publicly exposed: disclosing documents, emails, and credentials to what appears to be the Seaport Bid proposal system. Because I did not attempt any exploitation outside of that necessary to deem this a reportable issue, it is not cle...