# _aggregateValidFulfillmentOfferItems() can be tricked to accept invalid inputs

Seaport's errorBuffer OR-combines error codes 1 and 2 into unhandled 3, letting malformed orders with zero/overflow amounts fulfill at near-zero consideration.

- Payout: Contest reward
- Severity: high
- Program: OpenSea
- Credited: Spearbit
- Disclosed: 2022-08-30
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-05-opensea-seaport-findings/issues/75
- Library page: https://bugbountylibrary.com/r/c4%3A2022-05-opensea-seaport%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** FulfillmentApplier.sol order aggregation logic
**Root cause:** errorBuffer accumulates error flags via bitwise OR; combining zero-amount (1) and overflow (2) yields 3, which the switch statement does not handle and treats as success.
**Steps:**
1. Craft an offer containing two invalid items: one with zero amount and one causing total consideration overflow.
2. Call `matchOrders()` which routes through `_matchAdvancedOrders()` -> `_fulfillAdvancedOrders()` -> `_applyFulfillment()` -> `_aggregateValidFulfillmentOfferItems()`.
3. errorBuffer becomes `or(1, 2) = 3`.
4. Switch on errorBuffer has only `case 1` and `case 2`; value 3 falls through, no revert.
5. Order executes with malformed values, fulfilling at ~0 consideration (e.g. buy NFT for 1 DAI instead of 1000 DAI).
**How found:** Code review of the optimistic error-buffer pattern: noticed errorBuffer is a bitmask OR of flags but the switch only handles exact values 1 and 2, missing the combined 3.
**Exploitation:** Attacker submits a matched order set where one offer item has zero amount and another overflows the aggregate; the combined errorBuffer=3 bypasses validation, allowing the attacker to fulfill the order at a drastically reduced consideration.
**Insight:** When a validation routine accumulates error flags with bitwise OR but dispatches on exact enum values, check whether combinations of flags produce unhandled states that fall through as success.