AntFleet

Disagreement · 8dbec532-anthropic-4

Marketplace API doc claims 'API returns order data to sign' but the documented POST is the submit endpoint

solo Opus
repo a16d2030·PR #2·reviewed 1 week ago

Opus finding

Marketplace API doc claims 'API returns order data to sign' but the documented POST is the submit endpoint

mediumdocs-gaphigh
  • opensea/opensea-marketplace/references/marketplace-api.md:13
  • opensea/opensea-marketplace/references/marketplace-api.md:16
  • opensea/opensea-marketplace/references/marketplace-api.md:116-122
  • opensea/opensea-marketplace/references/marketplace-api.md:138-140
The overview and section header both claim that `POST /api/v2/orders/{chain}/seaport/listings` 'builds an unsigned Seaport listing order' and 'returns order parameters to sign'. But the documented request body already includes a `signature` field and `parameters` are required to be fully formed including `counter`, `salt`, `zone`, etc. In reality the OpenSea v2 listings endpoint is the *submission* endpoint — the caller constructs `parameters`, signs the EIP-712 OrderComponents, and POSTs both. The text later contradicts the early framing ('After signing, submit with protocol_address, the full parameters object...'). An agent following the 'Workflow: Selling an NFT' literally — 'POST then sign then submit' — would attempt a second POST to the same endpoint, or expect the first POST to return an unsigned order. This is a misleading-comment bug: the doc lies about behavior in two prominent places.

Recommendation

Rewrite the overview bullet and the 'Build a Listing' / 'Build an Offer' section headers to say 'Submit a signed Seaport listing/offer order' and remove the misleading 'returns order parameters to sign' phrasing. Update the 'Workflow: Selling an NFT' steps to remove the bogus 'Build then sign then submit again' phrasing.

Other reviewer

The other reviewer flagged nothing in this file/line range.

Why this didn't post

This finding didn't meet AntFleet's unanimous agreement threshold. Both frontier models review every PR independently; only findings they both flag with the same severity and category are posted to the PR. This one fell through.

read the methodology →