Talentir Token & Marketplace

Function `TalentirMarketplaceV1.cancelOrders()` may be front-runnable. This may be abused when the order owner wants to cancel one or more unfavorable market orders, while the front-runner observes pending transactions in the mempool, determines their profitability and executes a corresponding filling order with higher gas costs than that of the `cancelOrders()` call in order to have it executed before.

The `TalentirTokenV1` contract uses OpenSea's operator filter registry in order to blacklist the addresses and bytecode of markets that do not respect creator royalties. However, it is important to realize that the blacklist is not exhaustive, and it is still technically possible to circumvent creator royalties through a market that has not yet been blacklisted.

Certain contracts have state variables, e.g. `owner`, which provide certain addresses with privileged roles. Such roles may pose a risk to end-users. The `TalentirTokenV1.sol` contract contains the following privileged roles: 1. An administrative/[Owner role](https://docs.openzeppelin.com/contracts/2.x/access-control#ownership-and-ownable) (`_owner`, `onlyOwner()` modifier), as initialized during the `constructor()` execution to `msg.sender`: 1. Assign a new `_owner` address by calling `transferOwnership()`. 1. Renounce the role (**and thereby preventing any future calls to the followingly listed funcitons!**) by calling `renounceOwnership()`. 1. Pause/Unpause certain contract functionality by calling `pause()`/`unpause()`: 1. The minting of new tokens (`mint()`). 1. Approving addreses for all token transfers (`setApprovalForAll()`). 1. Transfer multiple amounts of the same token id to different addresses (`batchTransfer()`). 1. Perform token transfers (`safeTransferFrom()`). 1. Perform token transfers of multiple token id's and amounts(`safeBatchTransferFrom()`). 1. Change the royalty percentage for all tokes (any value up to `10%`) by calling `setRoyalty()`. 1. Change the minter role address by calling `setMinterRole()`. 1. Change the marketplace address by calling `setMarketplace()`. 1. A minter role (`_minterAddress`, `onlyMinter()` modifier) as set through the owner role (`_owner`) by calling `setMinterRole()`: 1. Mint new tokens by calling `mint()`. 1. **Arbitrarily transfer tokens on others behalf as being approved for all transfers until manually revoked by the talent/token owner by calling `setApprovalForAll(_minterAddress, false)`.** 1. Add/Remove addresses from being able to buy any tokens during presales (`hasGlobalPresaleAllowance[addr]`) by calling `setGlobalPresaleAllowance()`. 1. Add/Remove addresses from being able to buy specific tokens during presales (`hasTokenPresaleAllowance[addr][token]`) by calling `setTokenPresaleAllowance()`. 1. End the presale phase for any token at any time (thereby opening up the transfer to all addresses) by calling `endPresale()`. 1. Token transfers may be blocked (`batchTransfer()`, `safeTransferFrom()` and `safeBatchTransferFrom()`), due to the use of "Operators filterer" as defined/governed by [OpenSea's operator-filter-registry](https://github.com/ProjectOpenSea/operator-filter-registry/tree/v1.4.0) (with [address 0x3cc6CddA760b79bAfa08dF41ECFA224f810dCeB6](https://github.com/ProjectOpenSea/operator-filter-registry/blob/v1.4.0/src/lib/Constants.sol) being the filter contract address at version 1.4.0, at the time of publishing this report). 1. A marketplace address, as set through `setMarketplace()` by the owner role (`_owner`): 1. **Arbitrarily transfer tokens on others behalf as being approved for all transfers until manually revoked by the talent/token owner by calling `setApprovalForAll(_minterAddress, false)`.** The `TalentirTokenV1.sol` contract contains the following privileged roles: 1. An administrative/[Owner role](https://docs.openzeppelin.com/contracts/2.x/access-control#ownership-and-ownable) (`_owner`, `onlyOwner()` modifier), as initialized during the `constructor()` execution to `msg.sender`: 1. Assign a new `_owner` address by calling `transferOwnership()`. 1. Renounce the role (**and thereby preventing any future calls to the followingly listed funcitons!**) by calling `renounceOwnership()`. 1. Pause/Unpause certain contract functionality by calling `pause()`/`unpause()`: 1. Creating sell orders (`makeSellOrder()`). 1. Creating buy orders (`makeBuyOrder()`). 1. Change the Talentir fees (order fees) up to 10% at any time (`setTalentirFee()`). 1. Change the Talentir fee receiving address (`talentirFeeWallet`) at any time (`setTalentirFee()`).

If a user makes a buy/sell order with `_addOrderForRemaining == False`, then if the user input price is greater/lower than the `bestPrice` at the moment, their transaction will go through and and they will have effectively accomplished nothing. This could be particularly frustrating if the matching `bestPrice` existed at the time of submitting their transaction.

Within the `TalentirTokenV1.mint()` function, approval is given for all tokens belonging to the receiver of the minted tokens to both the `_approvedMarketplace` and the `minterAddress`. The Talentir team explained that the `minterAddress` represents their backend which should automatically place the first order on the market. However, there appears to be no reason for the approval of the `_approvedMarketplace`.