Read the findings of the 2022 Web3 Security Report

There is no contract implementation present for the interfaces `IEtherToken`,`IFeeRecipient`,`IPropertyValidator`, and `ITakerCallback` in the codebase. The scope of the audit treats 3rd party entities as black boxes and assumes their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.

Unknown Implementation of Interfaces

The contract is serving as the underlying entity to interact with third-party `exchange proxy`, and `ERC721 asset` protocols. The scope of the audit treats 3rd party entities as black boxes and assumes their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.

Third Party Dependencies

Element ERC721OrdersFeature is based on 0x Protocol V4. It’s an Off-Chain + On-Chain mechanism, it has the following potential issues:
1. The order transaction fees and the recipient of fees are specified by the order maker, therefore the platform may not receive any fees.
2. The buyer or seller may bear the risk of the transaction due to the fluctuation of the NFT trading price by the buyer or seller.

Financial models of blockchain protocols need to be resilient to attacks. It needs to pass simulations and verifications to guarantee the security of the overall protocol. Financial models are not in the scope of the audit.

Financial models

The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

Unlocked Compiler Version

The `for` loop within the functions take the unbounded array's length as the maximum iteration times. If the size of the array grows large, iterating through the entire array could be an expensive operation considering there are external calls in the `for` loop.

Potential Gas Exhaustion

Functions with names starting with `_` should be declared as `private`/`internal`.

Functions With `_` as Name Prefix Are Not `private` or `internal`

`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.

Improper Usage of `public` and `external` Type

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

Missing Error Messages

The linked statements do not affect the functionality of the codebase and appear to be either leftovers from test code or older functionality.

Redundant Code Components

In the function `_buyNFTEx()`, a taker callback function will be invoked when receiving the NFT token, however, the callback address is incorrect, it should be `params.taker` instead of `msg.sender` since the buyer is `params.taker`.
```solidity
bytes4 callbackResult = ITakerCallback(msg.sender).zeroExTakerCallback(orderInfo.orderHash, params.takerCallbackData);
```

Incorrect `ITakeCallBack` Address

As per the Element Contract Architecture, the ERC721OrdersFeature will be called from a delegated proxy. The function `WETH.withdraw()` unwraps WETH and transfers ETH to the delegated proxy contract, then transfers ETH to the taker via calling the function `_transferEth(), so please make sure the function `receive()` is declared in the delegate proxy contract to successfully receive the ETHs, also ensure the function `_fallback()` is not called in the function `receive()` to avoid the risk of gas inefficiency.
```solidity
  receive () external payable virtual {
      // no _fallback();
  }
```
And the implementation of the delegated proxy contract is not in the scope of this audit. 


Potential Unable to Receive ETH

Address should be checked before assignment to make sure it is not zero addresses. 

Lack of Zero Address Validation

If the value of `denominator` is 0, the linked operation will fail due to the divide by 0 error, which ultimately makes the invocation to `_resetDutchAuctionTokenAmountAndFees()` function fail.

Potential Division By Zero

The `erc20FillAmount` calculation is redundant for the NFT transaction since the `orderInfo.orderAmount` and `params.sellAmount` alway equal to 1.

Redundant Calculation for `erc20FillAmount`

The buyer can invoke the function `_buyNFT()` to buy the NFT, however, we can not find the callback logic to confirm the NFT is received by the buyer(msg.sender). We would like to confirm with the client if the current implementation aligns with the original project design.

``` solidity
// Invoke the callback
bytes4 callbackResult = ITakerCallback(msg.sender)
.zeroExTakerCallback(orderInfo.orderHash, params.takerCallbackData);
```


Logic Issue Of Function `_buyNFT()`

In the function `_buyNFTEx()`/`matchERC721Orders()`, the linked condition is almost never met. 

Conditions Are Never Met

The protocol is using some algorithms, including in the logic of the functions `_resetDutchAuctionTokenAmountAndFees()` and `_resetEnglishAuctionTokenAmountAndFees()`.
The Mathematical verification of these algorithms is not in the scope of this audit. The function logic will be checked based on the requirement documents.



Mathematical verification

Element.Market

LibERC721OrdersStorage.sol

IEtherToken.sol

LibNFTOrder.sol

LibCommonNftOrdersStorage.sol

IERC721OrdersFeature.sol

FixinERC721Spender.sol

ERC721OrdersFeature.sol

LibStorage.sol

NFTOrders.sol

LibSignature.sol

IPropertyValidator.sol

FixinEIP712.sol

IFeeRecipient.sol

ITakerCallback.sol

FixinTokenSpender.sol

Element NFT Marketplace

Phishing scammer Monkey Drainer has pilfered as much as $1M in Ethereum

Did Mark Zuckerberg’s Little Dance Actually Show Us Real Metaverse Legs? | Transparent NEWS

Ethereum (ETH) Sees High Volatility as U.S. Records Higher-Than-Expected GDP Growth

Apple Wants to Play in the Metaverse. Don't Expect It to Be Easy.

BTC price struggles at $21K as trader says ‘top is in’ for Bitcoin, Ethereum

An auditor in the metaverse. No proper tracking of cash or employees. New FTX CEO describes Sam Bankman-Fried’s haphazard management.

Cardano Founder Makes Staggering Prediction about BTC, XRP May Make Everyone Cry, SHIB Metaverse Team Reveals Crucial Update: Crypto News Digest by U.Today

Element NFT Marketplace

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

17

0

11

0

6