Can you please explain or share some useful links about how opensea manages to validate royalties amount and addresses? I was exploring seaport contract for a while and didn't get answers. The simplest case is "fulfillBasicOrder". This function has a lot of validations but I didn't find there how it validates additional recipients so it just makes ERC20 transfers through for loop with address and amount that came from an external source. I mean I can recreate EIP712 structure that uses opensea, fill additional recipients with needed addresses and sign it without using opensea UI, and similarly send transaction to fulfill basic order. - it is just my thoughts and I firmly believe that I am wrong just didn't find needed file. Does royalty data have to be validated on behalf of smart contract or smart contract can only validate the signature and then make all needed transfers?
2 Answers
It seems like your confusion here is mostly about how orders actually work. There is no section of Seaport that handles royalties specifically. The "address and amount that came from an external source" are part of the order, the same as any fee. When ever an order is created using OpenSea's front end, API, or some other marketplace building on top of seaport, you get to choose all the parts of the order to be fulfilled. That signed order is stored off-chain and includes an offer, for example it could be "User Alice sells 1 tubby cat with id 123, Alice receives 0.1 eth, tubby cat owner address receives .01 eth, opensea address receives, .005 eth". When the order is fulfilled each part of it is executed and it's someone meeting the offer. The royalty amount is calculated by the front end, or API, etc. and added as one of the parts of the offer.
Check out the structs section, you might find the OrderComponents comments really helpful: https://github.com/ProjectOpenSea/seaport/blob/main/contracts/lib/ConsiderationStructs.sol
-
Thank you so much for your answer! @CupOjoseph. However I have some confusions about the verification moment.– AGJoYyCommented Oct 18, 2022 at 10:02
-
So I do understand that the order structure is created offchain and signed also offchain. Onchain function like "fulfill order" accepts such arguments - signature, order parameters (royalties data is inculded). These parameters came from some external source and with the help of signature we can verify address that signed our order. My concern is whether order can be compromised, because there is no verification on behalf of seaport. Does valid signature means, that I can believe the data that came from outside? @CupOjoseph– AGJoYyCommented Oct 18, 2022 at 10:03
-
The entire order, including: - what NFT/item is sold by seller - How much is received by seller - How much is received by collection owner - How much is received by marketplace - any other conditions to meet.. are all signed into 1 valid order. Its not added later. Commented Oct 18, 2022 at 14:17
You can take a look at how royalties work in OpenSea and Seaport overview:
https://support.opensea.io/hc/en-us/articles/1500009575482-How-do-creator-earnings-work-on-OpenSea-
https://docs.opensea.io/docs/10-setting-fees-on-secondary-sales
