Audit Report
Paladin reviewed Heroes of NFT (Audit Report) on 14 Feb 2022: 28 findings, 0 critical; 9 marked fixed, 18 acknowledged, 1 open.
Report hosted on paladinsec.co.
Trustblock does not review code.
Findings28
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 2 |
| Medium | 0 | 3 | 3 |
| Low | 1 | 14 | 4 |
HighwithdrawFunds allow withdrawing of all reward tokens, and draining a pool that has the same staking token as reward tokenAcknowledged
The report gives no description here.
MediumAdding an address that does not implement the IERC20 interface will cause massUpdatePools and updatePool to failAcknowledged
The report gives no description here.
MediumFee-on-transfer tokens are not supportedAcknowledged
The report gives no description here.
MediumLack of maximum upper limit for deposit feesAcknowledged
The report gives no description here.
LowdelegateBySig can be frontrun and cause denial of serviceAcknowledged
The report gives no description here.
LowLack of events emission for sensitive state changesAcknowledged
The report gives no description here.
LowLack of maximum cap for honPerPeriodAcknowledged
The report gives no description here.
LowLack of non-zero address check in the constructor for devAddressAcknowledged
The report gives no description here.
LowLack of non-zero address check in the constructor for newFeeAddressAcknowledged
The report gives no description here.
LowMore robust check may be added for token address validity in initializeAcknowledged
The report gives no description here.
Show 8 more
LowOwnable is unnecessaryAcknowledged
The report gives no description here.
LowPool uses the contract balance to figure out the total depositsAcknowledged
The report gives no description here.
LowrewardPeriodMinutes will cause updatePool to revert if set as zeroAcknowledged
The report gives no description here.
LowRounding issue due to tokens with a very large supply can cause large supply tokens to receive zero emissionsAcknowledged
The report gives no description here.
LowUnnecessary casting of msg.sender into addressAcknowledged
The report gives no description here.
LowUnnecessary usage of SafeMathAcknowledged
The report gives no description here.
LowUnnecessary usage of SafeMathAcknowledged
The report gives no description here.
LowupdateEmissionRate will run out of gas if there are too many poolsAcknowledged
The report gives no description here.
Contracts in scope3
| Address | Chain | Source code |
|---|---|---|
| 0x9fa643d80093a3fc7b2bc7baed33512d9dc77abd | Chain: Avalanche | Source code: Verified source |
| 0xfa83d7888ae8b0a41fe4043733b28aa7c99f1b92 | Chain: Avalanche | Source code: Verified source |
| 0xed2b42d3c9c6e97e11755bb37df29b6375ede3eb | Chain: Avalanche | Source code: Verified source |
Part of Heroes of NFT’s security record
Heroes of NFTSecurity firm
Paladin176 projects reviewed · 241 reports · latest Apr 2025
See Paladin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us