zNS - Domain bid might be approved by non owner account
The spec allows anyone to place a bid for a domain, while only parent domain owners are allowed to approve a bid. Bid placement is actually enforced and purely informational. In practice, `approveDomainBid` allows any parent domain owner to approve bids (signatures) for any other domain even if they do not own it. Once approved, anyone can call `fulfillDomainBid` to create a domain.\\n```\\nfunction approveDomainBid(\\n    uint256 parentId,\\n    string memory bidIPFSHash,\\n    bytes memory signature\\n) external authorizedOwner(parentId) {\\n  bytes32 hashOfSig = keccak256(abi.encode(signature));\\n  approvedBids[hashOfSig] = true;\\n  emit DomainBidApproved(bidIPFSHash);\\n}\\n```\\n
Resolution\\nAddressed with zer0-os/[email protected] by storing the domain request data on-chain.\\nConsider adding a validation check that allows only the parent domain owner to approve bids on one of its domains. Reconsider the design of the system introducing more on-chain guarantees for bids.
```\\nfunction approveDomainBid(\\n    uint256 parentId,\\n    string memory bidIPFSHash,\\n    bytes memory signature\\n) external authorizedOwner(parentId) {\\n  bytes32 hashOfSig = keccak256(abi.encode(signature));\\n  approvedBids[hashOfSig] = true;\\n  emit DomainBidApproved(bidIPFSHash);\\n}\\n```\\n