NiftyApes - Seller Financing

Quantstamp20 Apr 2023Files named in the report

Quantstamp reviewed NiftyApes (NiftyApes - Seller Financing) on 20 Apr 2023: 20 findings, 0 critical; 11 marked fixed, 8 acknowledged, 1 open.

No open critical findings

Open the report Open NiftyApes’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings20

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	4
Medium	0	0	1
Low	1	8	6

LowMissing Input ValidationOpen

It is important to validate inputs, even if they only come from trusted addresses, to avoid human error. The following is a non-exhaustive list of places in the code that could benefit from extra input validation. * `SellerFinancing.initialize()`: * Validate `royaltiesEngineContractAddress` is not equal to the zero address. * Validate `delegateRegistryContractAddress` is not equal to the zero address. * Validate `seaportContractAddress` is not equal to the zero address. * Validate `wethContractAddress` is not equal to the zero address. * `SellerFinancing.buyWithFinancing()`: Validate that the `offer.periodInterestRateBps` does not exceed `MAX_BPS`. * `SellerFinancing._validateSaleOrder()`: Validate that the order doesn't use a conduit. * `MarketPlaceIntegration.updateMarketplaceFeeBps()`: Validate that the `newMarketplaceFeeBps` does not exceed `MAX_BPS`, or 100%.