Adventure Gold | Loot Staking

CertiK28 Oct 2022Files named in the report

CertiK reviewed Loot (Adventure Gold | Loot Staking) on 28 Oct 2022: 11 findings, 2 critical; 1 marked fixed, 7 acknowledged, 3 open.

1 critical acknowledged, not fixed

Open the report Open Loot’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings11

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	1	1
High	3	0	0
Medium	0	1	0
Low	0	5	0

CriticalLogic Issue For Function `claim()`Acknowledged

The function `claim` does not have any constraints to be invoked to mint the nft, so these nft can be minted to an address by anyone.

MediumPotential Flashloan AttackAcknowledged

Flash loans are a way to borrow large amounts of money for a certain fee. The requirement is that the loans need to be returned within the same transaction in a block. If not, the transaction will be reverted. If someone borrows `loot` from other protocols, he can gain `AGLD` token for free.

LowFake RandomnessAcknowledged

According to the logic, the function `random` needs to return a random number, however, if the input value is deterministic, then the return value is deterministic.

LowHardcode AddressAcknowledged

There is a hardcode addresses in this codebase.

LowLack of Zero Address ValidationAcknowledged

The given input is missing the check for the non-zero address.

LowMissing Emit EventsAcknowledged

Functions that affect the status of sensitive variables should be able to emit events as notifications to customers.

LowPotential Incorrect ChecksAcknowledged

If there are already a number of tokens in the contract, the passed-in `_amount` can be larger than the number of tokens transferred to the contract.