com.market0x/marketplace

marketplace

Buy, sell and bid on vote-escrow NFTs and .base.eth names. Non-custodial, settles on Seaport.

0.1.0
Version
remote
Transport
13
Tools

Security review

Review passed

Reviewed 21h ago.

  • tools: 13 tools scanned
  • metadata: scanned

No findings.

Tools (13)

  • list_micro_markets

    List the markets this marketplace facilitates (asset, chain, currencies, fee).

  • get_listings

    Active listings/auctions for a market. Each row carries the ask and the position's underlying contents priced at current market (published formula: /docs#data-sources), plus discountPct (the difference between them). Sorted by discount percentage, descending.

  • get_listing_details

    Full detail for one order including a FRESH live-contents snapshot (principal, claimable rewards, voting/earning power, as_of_block).

  • get_recent_trades

    Recently settled sales for a market. `amount` is the EXACT settled total (incl. fee) from the on-chain fill where the indexer recorded it, with `settledAt` the block time and `exact: true`; otherwise it falls back to the listed ask with `exact: false` (a decayed Dutch auction settles BELOW its listed amount, so treat inexact rows as an upper bound).

  • prepare_purchase

    Prepare the non-custodial transaction package to BUY a listing (or accept an offer): ordered approvals + Seaport fulfillOrder calldata + a fresh contents snapshot. prepared.summary quotes the CURRENT price (Dutch auctions interpolate, asOf says when); the approval grants approveBaseUnits — slightly above the quote on a decaying order, never above maxTotalBaseUnits — and Seaport charges the exact interpolated amount at fill. On auctions, prepared.cleanup is an optional post-settlement tx that zeroes the residual allowance. The agent's own wallet signs and submits — this never signs or holds keys.

  • prepare_offer

    Prepare a BID/offer on a position: returns the Seaport order to sign (EIP-712), the currency approval needed, and how to submit it. The agent reads its Seaport counter, signs, and POSTs the signed order — settlement stays on Seaport.

  • prepare_listing

    Prepare a SELL listing or Dutch auction. Verifies the seller OWNS the position and it's transferable (not voted/attached), builds the Seaport order with the Interface fee injected by the server, and returns the one-time NFT approval + EIP-712 typed data to sign. Never signs or holds keys.

  • prepare_cancel

    Prepare the on-chain Seaport cancel transaction for an active order. Only the order's offerer can execute it (Seaport enforces msg.sender == offerer), so the calldata is safe to return. After it confirms, POST { txHash } to the confirm endpoint to update the book.

  • get_orders

    List orders created by an address (its listings, auctions, offers). Status is reconciled by the background worker — treat as advisory until checked at fill.

  • get_owned_positions

    List the positions an address owns in a market, with listability (voted/attached positions can't transfer).

  • subscribe_notifications

    Subscribe a wallet to push notifications (order_filled / offer_received / saved_search) via an HMAC-signed webhook — the agent-native alternative to polling. Two-step: call WITHOUT `signature` to get the exact message to sign (EIP-191 personal_sign), then call again WITH the signature. `chainId` is signed over and the signature is verified on THAT chain, so pass the chain the wallet actually signs on (smart-wallet signatures do not validate cross-chain). Each signed message is SINGLE-USE: resending the same body returns 409 replayed_signature — retry with a fresh timestamp and a new signature. The response includes the webhook HMAC secret ONCE (verify x-market0x-signature = hex(HMAC-SHA256(rawBody, secret))).

  • list_subscriptions

    List a wallet's notification subscriptions (webhook URLs redacted to origin).

  • unsubscribe_notifications

    Delete a notification subscription. Two-step like subscribe_notifications: call without `signature` to get the message to sign. `chainId` is signed over and verified on that chain. Signed messages are single-use.