fix: normalize protocol addresses in cancelOrders batches

[Mabolla]

Thanks for opening a PR!

We really appreciate you taking the time to contribute. It means a lot to the OpenSea team and the broader developer community.

A quick note about how this repo works

This repository is a read-only mirror of a package maintained in an internal monorepo. Because of that, pull requests cannot be merged directly here.

But don't worry -- your contribution won't be lost! Here's what happens next:

1. Our team reviews every PR that comes in.
2. If the change looks good, we'll recreate it internally in our monorepo.
3. The fix will be synced back to this public repo on the next release.

We'll keep you posted on the PR as things progress.

Is this a bug report?

If you're reporting a bug rather than submitting a code fix, opening an issue is usually the fastest path to a resolution. Bug report issues help us triage and prioritize effectively.

Thanks again for helping make OpenSea better for everyone!

Summary

Fixes cancelOrders() rejecting a batch when its orders use differently-cased forms of the same Seaport protocol address.

Root cause

cancelOrders() validates each protocol address with requireValidProtocol(), which treats equivalent Ethereum address casing correctly, but then stores the original strings directly in a Set.

As a result, the same protocol address in lowercase/checksummed and uppercase form produced two entries, causing the batch to fail with:

All orders in a cancelOrders batch must share the same protocolAddress.

even though both orders refer to the same contract.

Changes

• Normalize validated protocol addresses with checksumAddress() before adding them to the batch protocol set.
• Preserve the existing rejection for genuinely different protocol addresses.
• Add a regression test using differently-cased forms of the same Seaport address.

Validation

• Regression test fails before the fix because the two casing variants are treated as different protocols.
• Targeted regression test: 1/1 passed after the fix.
• Full unit suite: 946/946 passed across 42 test files.
• Targeted Biome check passes for the changed files.

[ryanio]

Thanks. This one went in essentially as you wrote it, recreated in our internal monorepo as PR 649 (private repo, so that number will not resolve from here) and merged.

The detail you caught is that requireValidProtocol() compares addresses correctly, so validation passed, and then the raw string went into the Set. One protocol counted as several depending on how each order happened to spell it, and a batch that was entirely valid got refused with a message claiming its orders did not share a protocol address. The validation and the bookkeeping disagreed about what an address is, and only the bookkeeping was wrong.

checksumAddress() at the add call is the right place to normalize, since it leaves requireValidProtocol owning validation and leaves genuinely different protocols rejected. The regression test is well chosen too: asserting that the run reaches requireAccountIsAvailable exactly once proves the batch stayed one batch, rather than only proving the protocol error did not fire.

This repo is a mirror that publishes on release, so the change appears here on the next one.