Getwise security record

The esketitBuyBack function allows the owner to buy back tokens from esketit users who have given the marketplace an approval. This function allows for the owner to manually input the prices to pay from the esketitTreasury address. A malicious owner can exploit this function by providing zero value or amount less than the pricePerItem variable meant to serve as the cost of the tokens.

The marketplace allows users to list nft tokens that are verified by the platform owner. This is ascertained with the <em>esketitLoanBasket</em> mapping that serves verified nft addresses to true. In the listItem function, instead of a check that verifies the provided _nftAddress variable, the check instead checks if the msg.sender address is true. This will cause the function call to revert and deny users the list item functionality.

With the _setApprovalForAll function called at the constructor level, the esketitMarketplace contract becomes the only address that can transfer out tokens to buyers because these tokens are minted directly into the token contract itself. However, issue of stuck tokens arises when contract owner updates the esketitMarketplace variable to a new marketplace address, tokens in the token contract cannot be called by these new marketplace address because  approval was only set at the deployment time and  the approval won’t persist for new esketitMarketplace variables.

When a contract owner buys from Esketit Users via the esketitBuyBack function, the tokens are sent to an NFT address. If the contract address fails to implement the ERC721 receiver, the function will revert.

The current struct takes 3 slots and can be tight packed to help reduce gas consumption.

Zero addresses can be passed in without reverting, and any arbitrary amount can go in for platformFee as well. It is necessary to sanitize input to avoid breaks in code because of unexpected values.