{"componentChunkName":"component---node-modules-rocketseat-gatsby-theme-docs-core-src-templates-docs-query-js","path":"/manual-review/ExchangeCommitFacet-ECF","result":{"data":{"mdx":{"id":"a4560f77-a014-5dc8-a357-58738eb319c6","excerpt":"ECF-01M: Incorrect Message Sender Emission Type Severity Location Logical Fault ExchangeCommitFacet.sol:L916 Description: The  ExchangeCommitFacet…","fields":{"slug":"/manual-review/ExchangeCommitFacet-ECF/"},"frontmatter":{"title":"ExchangeCommitFacet Manual Review Findings","description":"Contains all the findings that relate to manual review on the contract codebase","image":null,"disableTableOfContents":null},"body":"var _excluded = [\"components\"];\n\nfunction _extends() { _extends = Object.assign || function (target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i]; for (var key in source) { if (Object.prototype.hasOwnProperty.call(source, key)) { target[key] = source[key]; } } } return target; }; return _extends.apply(this, arguments); }\n\nfunction _objectWithoutProperties(source, excluded) { if (source == null) return {}; var target = _objectWithoutPropertiesLoose(source, excluded); var key, i; if (Object.getOwnPropertySymbols) { var sourceSymbolKeys = Object.getOwnPropertySymbols(source); for (i = 0; i < sourceSymbolKeys.length; i++) { key = sourceSymbolKeys[i]; if (excluded.indexOf(key) >= 0) continue; if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue; target[key] = source[key]; } } return target; }\n\nfunction _objectWithoutPropertiesLoose(source, excluded) { if (source == null) return {}; var target = {}; var sourceKeys = Object.keys(source); var key, i; for (i = 0; i < sourceKeys.length; i++) { key = sourceKeys[i]; if (excluded.indexOf(key) >= 0) continue; target[key] = source[key]; } return target; }\n\n/* @jsxRuntime classic */\n\n/* @jsx mdx */\nvar _frontmatter = {\n  \"title\": \"ExchangeCommitFacet Manual Review Findings\",\n  \"description\": \"Contains all the findings that relate to manual review on the contract codebase\"\n};\nvar layoutProps = {\n  _frontmatter: _frontmatter\n};\nvar MDXLayout = \"wrapper\";\nreturn function MDXContent(_ref) {\n  var components = _ref.components,\n      props = _objectWithoutProperties(_ref, _excluded);\n\n  return mdx(MDXLayout, _extends({}, layoutProps, props, {\n    components: components,\n    mdxType: \"MDXLayout\"\n  }), mdx(\"h2\", {\n    \"id\": \"span-idecf-01mecf-01m-incorrect-message-sender-emissionspan\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h2\",\n    \"href\": \"#span-idecf-01mecf-01m-incorrect-message-sender-emissionspan\",\n    \"aria-label\": \"span idecf 01mecf 01m incorrect message sender emissionspan permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), mdx(\"span\", {\n    id: \"ECF-01M\"\n  }, \"ECF-01M: Incorrect Message Sender Emission\")), mdx(\"table\", null, mdx(\"thead\", {\n    parentName: \"table\"\n  }, mdx(\"tr\", {\n    parentName: \"thead\"\n  }, mdx(\"th\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Type\"), mdx(\"th\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Severity\"), mdx(\"th\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Location\"))), mdx(\"tbody\", {\n    parentName: \"table\"\n  }, mdx(\"tr\", {\n    parentName: \"tbody\"\n  }, mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"/reports/boson-protocol-version-2.5.0-68d13ccd7155940015e05fd3/appendix/finding-types#logical-fault\"\n  }, \"Logical Fault\")), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"img\", {\n    parentName: \"td\",\n    \"className\": \"o-severity o-minor\",\n    \"src\": \"https://omniscia.io/report-assets/minor.png\"\n  })), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"https://github.com/bosonprotocol/boson-protocol-contracts/blob/6a14c31bead936ed03b2d51ab82010ecd1047f40/contracts/protocol/facets/ExchangeCommitFacet.sol#L916\"\n  }, \"ExchangeCommitFacet.sol:L916\"))))), mdx(\"h3\", {\n    \"id\": \"description\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#description\",\n    \"aria-label\": \"description permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Description:\"), mdx(\"p\", null, \"The \", mdx(\"a\", {\n    parentName: \"p\",\n    \"href\": \"https://github.com/bosonprotocol/boson-protocol-contracts/blob/6a14c31bead936ed03b2d51ab82010ecd1047f40/contracts/protocol/facets/ExchangeCommitFacet.sol#L877-L918\"\n  }, mdx(\"inlineCode\", {\n    parentName: \"a\"\n  }, \"ExchangeCommitFacet::handleDRFeeCollection\")), \" function will incorrectly emit the \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"msg.sender\"), \" as the executor of the fee request whereas other event emissions will use the properly-evaluated \", mdx(\"a\", {\n    parentName: \"p\",\n    \"href\": \"https://github.com/bosonprotocol/boson-protocol-contracts/blob/6a14c31bead936ed03b2d51ab82010ecd1047f40/contracts/protocol/bases/ProtocolBase.sol#L658-L668\"\n  }, mdx(\"inlineCode\", {\n    parentName: \"a\"\n  }, \"ProtocolBase::_msgSender\")), \".\"), mdx(\"h3\", {\n    \"id\": \"impact\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#impact\",\n    \"aria-label\": \"impact permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Impact:\"), mdx(\"p\", null, \"The \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"DRFeeRequested\"), \" event will be emitted with a misleading executor data point in the current implementation.\"), mdx(\"h3\", {\n    \"id\": \"example\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#example\",\n    \"aria-label\": \"example permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Example:\"), mdx(\"pre\", null, mdx(\"code\", {\n    parentName: \"pre\",\n    \"className\": \"language-sol\",\n    \"metastring\": \"title=contracts/protocol/facets/ExchangeCommitFacet.sol highlight={7} lineNumbers=true lineOffset=909\",\n    \"title\": \"contracts/protocol/facets/ExchangeCommitFacet.sol\",\n    \"highlight\": \"{7}\",\n    \"lineNumbers\": \"true\",\n    \"lineOffset\": \"909\"\n  }, \"// Emit event for DR fee request\\nemit IBosonFundsBaseEvents.DRFeeRequested(\\n    _exchangeId,\\n    exchangeToken,\\n    _drFeeAmount,\\n    _disputeTerms.mutualizerAddress,\\n    msg.sender\\n);\\n\")), mdx(\"h3\", {\n    \"id\": \"recommendation\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#recommendation\",\n    \"aria-label\": \"recommendation permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Recommendation:\"), mdx(\"p\", null, \"We advise the proper message sender to be resolved to ensure consistency across the codebase.\"), mdx(\"h3\", {\n    \"id\": \"alleviation-efd5d1a8f23c3bca7c25273ea4c912a367250119\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#alleviation-efd5d1a8f23c3bca7c25273ea4c912a367250119\",\n    \"aria-label\": \"alleviation efd5d1a8f23c3bca7c25273ea4c912a367250119 permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Alleviation (efd5d1a8f23c3bca7c25273ea4c912a367250119):\"), mdx(\"p\", null, \"The event emission was updated to properly utilize the \", mdx(\"a\", {\n    parentName: \"p\",\n    \"href\": \"https://github.com/bosonprotocol/boson-protocol-contracts/blob/efd5d1a8f23c3bca7c25273ea4c912a367250119/contracts/protocol/bases/ProtocolBase.sol#L658-L668\"\n  }, mdx(\"inlineCode\", {\n    parentName: \"a\"\n  }, \"ProtocolBase::_msgSender\")), \", addressing this exhibit.\"), mdx(ViewDiffButton, {\n    repoUrl: \"https://github.com/bosonprotocol/boson-protocol-contracts\",\n    mainHash: \"6a14c31bead936ed03b2d51ab82010ecd1047f40\",\n    fixHash: \"efd5d1a8f23c3bca7c25273ea4c912a367250119\",\n    gitHubIssue: \"1052\",\n    mdxType: \"ViewDiffButton\"\n  }), mdx(\"h2\", {\n    \"id\": \"span-idecf-02mecf-02m-inexistent-validation-of-mutualizer-interface-conformityspan\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h2\",\n    \"href\": \"#span-idecf-02mecf-02m-inexistent-validation-of-mutualizer-interface-conformityspan\",\n    \"aria-label\": \"span idecf 02mecf 02m inexistent validation of mutualizer interface conformityspan permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), mdx(\"span\", {\n    id: \"ECF-02M\"\n  }, \"ECF-02M: Inexistent Validation of Mutualizer Interface Conformity\")), mdx(\"table\", null, mdx(\"thead\", {\n    parentName: \"table\"\n  }, mdx(\"tr\", {\n    parentName: \"thead\"\n  }, mdx(\"th\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Type\"), mdx(\"th\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Severity\"), mdx(\"th\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Location\"))), mdx(\"tbody\", {\n    parentName: \"table\"\n  }, mdx(\"tr\", {\n    parentName: \"tbody\"\n  }, mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"/reports/boson-protocol-version-2.5.0-68d13ccd7155940015e05fd3/appendix/finding-types#input-sanitization\"\n  }, \"Input Sanitization\")), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"img\", {\n    parentName: \"td\",\n    \"className\": \"o-severity o-minor\",\n    \"src\": \"https://omniscia.io/report-assets/minor.png\"\n  })), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"https://github.com/bosonprotocol/boson-protocol-contracts/blob/6a14c31bead936ed03b2d51ab82010ecd1047f40/contracts/protocol/facets/ExchangeCommitFacet.sol#L962\"\n  }, \"ExchangeCommitFacet.sol:L962\"))))), mdx(\"h3\", {\n    \"id\": \"description-1\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#description-1\",\n    \"aria-label\": \"description 1 permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Description:\"), mdx(\"p\", null, \"In contrast to the \", mdx(\"a\", {\n    parentName: \"p\",\n    \"href\": \"https://github.com/bosonprotocol/boson-protocol-contracts/blob/6a14c31bead936ed03b2d51ab82010ecd1047f40/contracts/protocol/bases/OfferBase.sol#L185-L390\"\n  }, mdx(\"inlineCode\", {\n    parentName: \"a\"\n  }, \"OfferBase::storeOffer\")), \" function, the \", mdx(\"a\", {\n    parentName: \"p\",\n    \"href\": \"https://github.com/bosonprotocol/boson-protocol-contracts/blob/6a14c31bead936ed03b2d51ab82010ecd1047f40/contracts/protocol/facets/ExchangeCommitFacet.sol#L934-L967\"\n  }, mdx(\"inlineCode\", {\n    parentName: \"a\"\n  }, \"ExchangeCommitFacet::addSellerParametersToBuyerOffer\")), \" function does not validate that the \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"_sellerParams.mutualizerAddress\"), \" adheres to the expected mutualizer interface.\"), mdx(\"h3\", {\n    \"id\": \"impact-1\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#impact-1\",\n    \"aria-label\": \"impact 1 permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Impact:\"), mdx(\"p\", null, \"A non-functional mutualizer can be presently configured in the \", mdx(\"a\", {\n    parentName: \"p\",\n    \"href\": \"https://github.com/bosonprotocol/boson-protocol-contracts/blob/6a14c31bead936ed03b2d51ab82010ecd1047f40/contracts/protocol/facets/ExchangeCommitFacet.sol#L934-L967\"\n  }, mdx(\"inlineCode\", {\n    parentName: \"a\"\n  }, \"ExchangeCommitFacet::addSellerParametersToBuyerOffer\")), \" function.\"), mdx(\"h3\", {\n    \"id\": \"example-1\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#example-1\",\n    \"aria-label\": \"example 1 permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Example:\"), mdx(\"pre\", null, mdx(\"code\", {\n    parentName: \"pre\",\n    \"className\": \"language-sol\",\n    \"metastring\": \"title=contracts/protocol/facets/ExchangeCommitFacet.sol highlight={29} lineNumbers=true lineOffset=933\",\n    \"title\": \"contracts/protocol/facets/ExchangeCommitFacet.sol\",\n    \"highlight\": \"{29}\",\n    \"lineNumbers\": \"true\",\n    \"lineOffset\": \"933\"\n  }, \"function addSellerParametersToBuyerOffer(\\n    address _committer,\\n    uint256 _offerId,\\n    SellerOfferParams calldata _sellerParams\\n) internal returns (BosonTypes.Offer storage offer) {\\n    offer = getValidOffer(_offerId);\\n    if (offer.priceType != PriceType.Static) revert InvalidPriceType();\\n    if (offer.creator != OfferCreator.Buyer) revert InvalidOfferCreator();\\n\\n    (bool sellerExists, uint256 sellerId) = getSellerIdByAssistant(_committer);\\n    if (!sellerExists) revert NotAssistant();\\n    offer.sellerId = sellerId;\\n\\n    {\\n        ProtocolLib.ProtocolLookups storage lookups = protocolLookups();\\n        if (_sellerParams.collectionIndex > 0) {\\n            if (lookups.additionalCollections[sellerId].length < _sellerParams.collectionIndex) {\\n                revert NoSuchCollection();\\n            }\\n            offer.collectionIndex = _sellerParams.collectionIndex;\\n        }\\n\\n        validateRoyaltyInfo(lookups, protocolLimits(), sellerId, _sellerParams.royaltyInfo);\\n\\n        offer.royaltyInfo[0] = _sellerParams.royaltyInfo;\\n\\n        if (_sellerParams.mutualizerAddress != address(0)) {\\n            DisputeResolutionTerms storage disputeTerms = fetchDisputeResolutionTerms(_offerId);\\n            disputeTerms.mutualizerAddress = _sellerParams.mutualizerAddress;\\n        }\\n\\n        emit BuyerInitiatedOfferSetSellerParams(_offerId, sellerId, _sellerParams, _committer);\\n    }\\n}\\n\")), mdx(\"h3\", {\n    \"id\": \"recommendation-1\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#recommendation-1\",\n    \"aria-label\": \"recommendation 1 permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Recommendation:\"), mdx(\"p\", null, \"We advise such validation to be imposed, ensuring the updated mutualizer satisfies the expected interface.\"), mdx(\"h3\", {\n    \"id\": \"alleviation-efd5d1a8f23c3bca7c25273ea4c912a367250119-1\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#alleviation-efd5d1a8f23c3bca7c25273ea4c912a367250119-1\",\n    \"aria-label\": \"alleviation efd5d1a8f23c3bca7c25273ea4c912a367250119 1 permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Alleviation (efd5d1a8f23c3bca7c25273ea4c912a367250119):\"), mdx(\"p\", null, \"The mutualizer interface validation has been introduced to the \", mdx(\"a\", {\n    parentName: \"p\",\n    \"href\": \"https://github.com/bosonprotocol/boson-protocol-contracts/blob/efd5d1a8f23c3bca7c25273ea4c912a367250119/contracts/protocol/facets/ExchangeCommitFacet.sol#L934-L967\"\n  }, mdx(\"inlineCode\", {\n    parentName: \"a\"\n  }, \"ExchangeCommitFacet::addSellerParametersToBuyerOffer\")), \" function as advised.\"), mdx(ViewDiffButton, {\n    repoUrl: \"https://github.com/bosonprotocol/boson-protocol-contracts\",\n    mainHash: \"6a14c31bead936ed03b2d51ab82010ecd1047f40\",\n    fixHash: \"efd5d1a8f23c3bca7c25273ea4c912a367250119\",\n    gitHubIssue: \"1053\",\n    mdxType: \"ViewDiffButton\"\n  }), mdx(\"h2\", {\n    \"id\": \"span-idecf-03mecf-03m-fee-mutualizer-fund-extraction-via-re-entrancyspan\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h2\",\n    \"href\": \"#span-idecf-03mecf-03m-fee-mutualizer-fund-extraction-via-re-entrancyspan\",\n    \"aria-label\": \"span idecf 03mecf 03m fee mutualizer fund extraction via re entrancyspan permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), mdx(\"span\", {\n    id: \"ECF-03M\"\n  }, \"ECF-03M: Fee Mutualizer Fund Extraction via Re-Entrancy\")), mdx(\"table\", null, mdx(\"thead\", {\n    parentName: \"table\"\n  }, mdx(\"tr\", {\n    parentName: \"thead\"\n  }, mdx(\"th\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Type\"), mdx(\"th\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Severity\"), mdx(\"th\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Location\"))), mdx(\"tbody\", {\n    parentName: \"table\"\n  }, mdx(\"tr\", {\n    parentName: \"tbody\"\n  }, mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"/reports/boson-protocol-version-2.5.0-68d13ccd7155940015e05fd3/appendix/finding-types#logical-fault\"\n  }, \"Logical Fault\")), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"img\", {\n    parentName: \"td\",\n    \"className\": \"o-severity o-major\",\n    \"src\": \"https://omniscia.io/report-assets/major.png\"\n  })), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"https://github.com/bosonprotocol/boson-protocol-contracts/blob/6a14c31bead936ed03b2d51ab82010ecd1047f40/contracts/protocol/facets/ExchangeCommitFacet.sol#L472\"\n  }, \"ExchangeCommitFacet.sol:L472\"), \", \", mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"https://github.com/bosonprotocol/boson-protocol-contracts/blob/6a14c31bead936ed03b2d51ab82010ecd1047f40/contracts/protocol/facets/ExchangeCommitFacet.sol#L554\"\n  }, \"L554\"), \", \", mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"https://github.com/bosonprotocol/boson-protocol-contracts/blob/6a14c31bead936ed03b2d51ab82010ecd1047f40/contracts/protocol/facets/ExchangeCommitFacet.sol#L637\"\n  }, \"L637\"), \", \", mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"https://github.com/bosonprotocol/boson-protocol-contracts/blob/6a14c31bead936ed03b2d51ab82010ecd1047f40/contracts/protocol/facets/ExchangeCommitFacet.sol#L664\"\n  }, \"L664\"), \", \", mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"https://github.com/bosonprotocol/boson-protocol-contracts/blob/6a14c31bead936ed03b2d51ab82010ecd1047f40/contracts/protocol/facets/ExchangeCommitFacet.sol#L890\"\n  }, \"L890\"), \", \", mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"https://github.com/bosonprotocol/boson-protocol-contracts/blob/6a14c31bead936ed03b2d51ab82010ecd1047f40/contracts/protocol/facets/ExchangeCommitFacet.sol#L901\"\n  }, \"L901\"))))), mdx(\"h3\", {\n    \"id\": \"description-2\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#description-2\",\n    \"aria-label\": \"description 2 permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Description:\"), mdx(\"p\", null, \"The BPIP-8 standard introduced to the Boson Protocol system involves a novel dispute resolution fee mutualizer implementation meant to facilitate the provision of dispute resolution fees at a premium instead of forcing buyers or sellers to contribute them.\"), mdx(\"p\", null, \"A complex re-entrancy attack has been introduced as a result of this feature due to how the dispute resolution fee is requested and captured.\"), mdx(\"p\", null, \"Specifically, the \", mdx(\"a\", {\n    parentName: \"p\",\n    \"href\": \"https://github.com/bosonprotocol/boson-protocol-contracts/blob/6a14c31bead936ed03b2d51ab82010ecd1047f40/contracts/protocol/facets/ExchangeCommitFacet.sol#L877-L918\"\n  }, mdx(\"inlineCode\", {\n    parentName: \"a\"\n  }, \"ExchangeCommitFacet::handleDRFeeCollection\")), \" function will measure the balance before and after the \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"IDRFeeMutualizer::requestDRFee\"), \" function call. A re-entrancy would permit the same balance delta (i.e. single transfer) to be measured as if multiple transfers occurred, thereby crediting an arbitrary number \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"n\"), \" of dispute resolution fees through a single transfer.\"), mdx(\"p\", null, \"While most of the codebase is protected against re-entrancy attacks, a previously-established security assumption is now breached in the \", mdx(\"a\", {\n    parentName: \"p\",\n    \"href\": \"https://github.com/bosonprotocol/boson-protocol-contracts/blob/6a14c31bead936ed03b2d51ab82010ecd1047f40/contracts/protocol/facets/ExchangeCommitFacet.sol#L564-L667\"\n  }, mdx(\"inlineCode\", {\n    parentName: \"a\"\n  }, \"ExchangeCommitFacet::onPremintedVoucherTransferred\")), \" function.\"), mdx(\"p\", null, \"As the function is not protected against re-entrancy guards, it is possible to execute the described re-entrancy attack through the function via single user controlled buyers and sellers.\"), mdx(\"p\", null, \"As multiple dispute resolution fees would be credited through a single transfer, fund extraction is possible by simply refunding all credited dispute resolution fees through the \", mdx(\"a\", {\n    parentName: \"p\",\n    \"href\": \"https://github.com/bosonprotocol/boson-protocol-contracts/blob/6a14c31bead936ed03b2d51ab82010ecd1047f40/contracts/protocol/bases/FundsBase.sol#L118-L281\"\n  }, mdx(\"inlineCode\", {\n    parentName: \"a\"\n  }, \"FundsBase::releaseFunds\")), \" path.\"), mdx(\"h3\", {\n    \"id\": \"impact-2\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#impact-2\",\n    \"aria-label\": \"impact 2 permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Impact:\"), mdx(\"p\", null, \"A re-entrancy edge case has been introduced in the Boson Protocol system through the BPIP-8 implementation that can result in fund loss for the protocol.\"), mdx(\"h3\", {\n    \"id\": \"example-2\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#example-2\",\n    \"aria-label\": \"example 2 permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Example:\"), mdx(\"pre\", null, mdx(\"code\", {\n    parentName: \"pre\",\n    \"className\": \"language-sol\",\n    \"metastring\": \"title=contracts/protocol/facets/ExchangeCommitFacet.sol highlight={2,5,6,7,8,9,10,11,13} lineNumbers=true lineOffset=888\",\n    \"title\": \"contracts/protocol/facets/ExchangeCommitFacet.sol\",\n    \"highlight\": \"{2,5,6,7,8,9,10,11,13}\",\n    \"lineNumbers\": \"true\",\n    \"lineOffset\": \"888\"\n  }, \"// Use mutualizer: request fee\\nuint256 balanceBefore = getBalance(exchangeToken);\\n\\n// Request DR fee from mutualizer\\nbool success = IDRFeeMutualizer(mutualizer).requestDRFee(\\n    _offer.sellerId,\\n    _drFeeAmount,\\n    exchangeToken,\\n    _exchangeId,\\n    _disputeTerms.disputeResolverId\\n);\\n\\nuint256 balanceAfter = getBalance(exchangeToken);\\n\")), mdx(\"h3\", {\n    \"id\": \"recommendation-2\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#recommendation-2\",\n    \"aria-label\": \"recommendation 2 permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Recommendation:\"), mdx(\"p\", null, \"There are multiple approaches in addressing this particular issue, with one being the validation of mutualizer addresses against a list of authorized implementations.\"), mdx(\"p\", null, \"An alternative approach would be to introduce an \\\"atomic\\\" re-entrancy guard to the \", mdx(\"a\", {\n    parentName: \"p\",\n    \"href\": \"https://github.com/bosonprotocol/boson-protocol-contracts/blob/6a14c31bead936ed03b2d51ab82010ecd1047f40/contracts/protocol/facets/ExchangeCommitFacet.sol#L877-L918\"\n  }, mdx(\"inlineCode\", {\n    parentName: \"a\"\n  }, \"ExchangeCommitFacet::handleDRFeeCollection\")), \" function block that prevents this particular function from being re-entered.\"), mdx(\"h3\", {\n    \"id\": \"alleviation-efd5d1a8f23c3bca7c25273ea4c912a367250119-2\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#alleviation-efd5d1a8f23c3bca7c25273ea4c912a367250119-2\",\n    \"aria-label\": \"alleviation efd5d1a8f23c3bca7c25273ea4c912a367250119 2 permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Alleviation (efd5d1a8f23c3bca7c25273ea4c912a367250119):\"), mdx(\"p\", null, \"A localized re-entrancy guard was introduced to the \", mdx(\"a\", {\n    parentName: \"p\",\n    \"href\": \"https://github.com/bosonprotocol/boson-protocol-contracts/blob/efd5d1a8f23c3bca7c25273ea4c912a367250119/contracts/protocol/facets/ExchangeCommitFacet.sol#L564-L667\"\n  }, mdx(\"inlineCode\", {\n    parentName: \"a\"\n  }, \"ExchangeCommitFacet::onPremintedVoucherTransferred\")), \" function preventing re-entrancies from triggering automatic commitments to offers more than once in a single transfer, thereby eliminating the re-entrancy risk outlined and thus alleviating this exhibit.\"), mdx(ViewDiffButton, {\n    repoUrl: \"https://github.com/bosonprotocol/boson-protocol-contracts\",\n    mainHash: \"6a14c31bead936ed03b2d51ab82010ecd1047f40\",\n    fixHash: \"efd5d1a8f23c3bca7c25273ea4c912a367250119\",\n    gitHubIssue: \"1062\",\n    mdxType: \"ViewDiffButton\"\n  }));\n}\n;\nMDXContent.isMDXComponent = true;","headings":[{"depth":2,"value":"<span id=\"ECF-01M\">ECF-01M: Incorrect Message Sender Emission</span>"},{"depth":3,"value":"Description:"},{"depth":3,"value":"Impact:"},{"depth":3,"value":"Example:"},{"depth":3,"value":"Recommendation:"},{"depth":3,"value":"Alleviation (efd5d1a8f23c3bca7c25273ea4c912a367250119):"},{"depth":2,"value":"<span id=\"ECF-02M\">ECF-02M: Inexistent Validation of Mutualizer Interface Conformity</span>"},{"depth":3,"value":"Description:"},{"depth":3,"value":"Impact:"},{"depth":3,"value":"Example:"},{"depth":3,"value":"Recommendation:"},{"depth":3,"value":"Alleviation (efd5d1a8f23c3bca7c25273ea4c912a367250119):"},{"depth":2,"value":"<span id=\"ECF-03M\">ECF-03M: Fee Mutualizer Fund Extraction via Re-Entrancy</span>"},{"depth":3,"value":"Description:"},{"depth":3,"value":"Impact:"},{"depth":3,"value":"Example:"},{"depth":3,"value":"Recommendation:"},{"depth":3,"value":"Alleviation (efd5d1a8f23c3bca7c25273ea4c912a367250119):"}]}},"pageContext":{"slug":"/manual-review/ExchangeCommitFacet-ECF/","prev":{"label":"EIP712Lib.sol (EIP-M)","link":"/manual-review/EIP712Lib-EIP"},"next":{"label":"FundsBase.sol (FBE-M)","link":"/manual-review/FundsBase-FBE"}}},"staticQueryHashes":["1954253342","2328931024","2501019404","973074209"]}