Illuvium Land Sale Protocol

CertiK18 May 2022Files named in the report

CertiK reviewed Illuvium (Illuvium Land Sale Protocol) on 18 May 2022: 7 findings, 0 critical; 6 marked fixed, 1 acknowledged.

No open critical findings

Open the report Open Illuvium’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings7

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	0	0
High	1	0
Medium	0	0
Low	0	6

Low`_pauseDuration` Incorrectly EmittedFixed

In the function `initialize()`, when the sale is in paused state, the value of `_pauseDuration` will be incorrectly emitted in the `Resumed` event.

LowHardcoded Oracle Answer Update TimeframeFixed

The oracle update timeframe is hardcoded as 30 days, which lacks of readability and maintenance

LowLack of Input ValidationFixed

in `setMetadata()`, there are no input validations on `Site Type` and `Landmark Type ID`, where - `Site Type` must be in the range of [1, 6] - `Landmark Type ID` must be in the range of [0, 7]

LowMissing Emit EventsFixed

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

LowMissing Error MessagesFixed

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

LowRequisite Value of ERC-20 `transferFrom()` / `traFixed

While the ERC-20 implementation does necessitate that the `transferFrom()` / `transfer()` function returns a `bool` variable yielding `true`, many token implementations do not return anything i.e. Tether (USDT) leading to unexpected halts in code execution.