Add length check to MultiAsset encoding

2 files changed, 8 insertions, 1 deletions

diff --git a/packages/order-utils/src/asset_data_utils.ts b/packages/order-utils/src/asset_data_utils.ts
index b5cfe698e..0b32cf216 100644
--- a/packages/order-utils/src/asset_data_utils.ts
+++ b/packages/order-utils/src/asset_data_utils.ts
@@ -73,6 +73,13 @@ export const assetDataUtils = {
      * @return The hex encoded assetData string
      */
     encodeMultiAssetData(amounts: BigNumber[], nestedAssetData: string[]): string {
+        if (amounts.length !== nestedAssetData.length) {
+            throw new Error(
+                `Invalid MultiAsset arguments. Expected length of 'amounts' (${
+                    amounts.length
+                }) to equal length of 'nestedAssetData' (${nestedAssetData.length})`,
+            );
+        }
         _.forEach(nestedAssetData, assetDataElement => assetDataUtils.validateAssetDataOrThrow(assetDataElement));
         const abiEncoder = new AbiEncoder.Method(constants.MULTI_ASSET_METHOD_ABI as MethodAbi);
         const args = [amounts, nestedAssetData];
diff --git a/packages/order-utils/src/store/balance_and_proxy_allowance_lazy_store.ts b/packages/order-utils/src/store/balance_and_proxy_allowance_lazy_store.ts
index 0bbaa844a..ae3e36238 100644
--- a/packages/order-utils/src/store/balance_and_proxy_allowance_lazy_store.ts
+++ b/packages/order-utils/src/store/balance_and_proxy_allowance_lazy_store.ts
@@ -122,7 +122,7 @@ export class BalanceAndProxyAllowanceLazyStore implements AbstractBalanceAndProx
                 const decodedAssetData = assetDataUtils.decodeERC721AssetData(assetData);
                 if (
                     decodedAssetData.assetProxyId === AssetProxyId.ERC721 &&
-                    !_.isUndefined(decodedAssetData.tokenAddress) &&
+                    decodedAssetData.tokenAddress === tokenAddress &&
                     !_.isUndefined(this._proxyAllowance[assetData][userAddress])
                 ) {
                     delete this._proxyAllowance[assetData][userAddress];