Reality Metaverse security record

The `createAuction()` function allows the user to input their own `stableExchangeRate`. This value is used in converting from the `mainCurrency` value to the `stableCurrency` value so users may bid in more than one currency during the auction. However, malicious users could enter a `stableExchangeRate` that is much higher than the main currency's value on exchanges. Moreover, the bidding functions do not check the success of token transfers, meaning it is possible these transfers can fail without reverting. With this in mind, it is possible for an attack to be conducted on stable currency balances held in the contract.

The contracts cited are serving as the underlying entity to interact with one or more third party protocols. The scope of the audit treats third party entities as black boxes and assumes their functional correctness. However, in the real world, third parties can be compromised or malicious and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=64 IERC1155 private immutable _auctionableNft; ``` - The contract `AuctionHouse` interacts with third party contract with `IERC1155` interface via `_auctionableNft`. --- ```solidity=68 IERC20 public immutable mainCurrency; ``` - The contract `AuctionHouse` interacts with third party contract with `IERC20` interface via `mainCurrency`. --- ```solidity=72 IERC20 public immutable stableCurrency; ``` - The contract `AuctionHouse` interacts with third party contract with `IERC20` interface via `stableCurrency`. --- ```solidity=21 IRealityProperties internal immutable entity; ``` - The contract `RealityPropertiesERC20Adapter` interacts with third party contract with `IRealityProperties` interface via `entity`. --- ```solidity=23 IERC20 public immutable erc20Contract; ``` - The contract `RealityVesting` interacts with third party contract with `IERC20` interface via `erc20Contract`. --- ```solidity=34 IERC20 public immutable token; ``` - The contract `VoucherPayment` interacts with third party contract with `IERC20` interface via `token`. --- ```solidity=77 function buyOnOffer(address sellerAddress, bytes calldata signature, TradeOffer calldata offer) external payable { ``` - The function `Trade.buyOnOffer` interacts with third party contract with `IERC20Upgradeable` interface via `offer`. --- ```solidity=173 function _sellOnBidTo(address buyerAddress, bytes calldata signature, TradeBid calldata bid, address to) internal { ``` - The function `Trade._sellOnBidTo` interacts with third party contract with `IERC20Upgradeable` interface via `bid`. --- ```solidity=287 function emergencyTradeTokenWithdrawal(address tradeTokenAddress, address recipient, uint256 amount) external onlyOwner { ``` - The function `Trade.emergencyTradeTokenWithdrawal` interacts with third party contract with `IERC20Upgradeable` interface via `tradeTokenAddress`. --- ```solidity=102 function itemTokenByIndex(uint256 index) external view returns (address tokenAddress, address handlerAddress, bool isCurrentlySupported) { ``` - The function `TradeConfig.itemTokenByIndex` interacts with third party contract with `IHandler` interface via `handlerAddress`. --- ```solidity=79 function put(address from, address to, address tokenContract, uint256 tokenId, uint256 amount, bytes32 /*stateHash*/) external override onlyModule { ``` - The function `ERC1155Handler.put` interacts with third party contract with `IERC1155` interface via `tokenContract`. --- ```solidity=85 function batchPut(address from, address to, address tokenContract, uint256[] calldata tokenIds, uint256[] calldata amounts) external override onlyModule { ``` - The function `ERC1155Handler.batchPut` interacts with third party contract with `IERC1155` interface via `tokenContract`. --- ```solidity=95 function take(address recipient, address owner, address tokenContract, uint256 tokenId, uint256 amount) external override onlyModule { ``` - The function `ERC1155Handler.take` interacts with third party contract with `IERC1155` interface via `tokenContract`. --- ```solidity=101 function batchTake(address recipient, address owner, address tokenContract, uint256[] calldata tokenIds, uint256[] calldata amounts) external override onlyModule { ``` - The function `ERC1155Handler.batchTake` interacts with third party contract with `IERC1155` interface via `tokenContract`. --- ```solidity=111 function transferFrom(address tokenAddress, address from, address to, uint256 tokenId, uint256 amount, bytes32 /*stateHash*/) external override onlyModule { ``` - The function `ERC1155Handler.transferFrom` interacts with third party contract with `IERC1155` interface via `tokenAddress`. --- ```solidity=115 function batchTransferFrom(address tokenAddress, address from, address to, uint256[] calldata tokenIds, uint256[] calldata amounts) external override onlyModule { ``` - The function `ERC1155Handler.batchTransferFrom` interacts with third party contract with `IERC1155` interface via `tokenAddress`.

The function `ownerOf()` reverts when called with message "not implemented." Functions that are not used should be removed or implemented.

The return value of a call is not stored in a local or state variable. --- ```solidity=59 _tokenAddressToHandlerAddress.set(tokenAddress, address(handler)); ``` --- ```solidity=67 _tradeTokens.set(tokenAddress, EnumerableMap.SupportState.SUPPORTED); ``` --- ```solidity=81 _tradeTokens.set(tokenAddress, EnumerableMap.SupportState.SUPPORT_STOPPED); ```