Adventure Gold | Loot Staking
CertiK reviewed Loot (Adventure Gold | Loot Staking) on 28 Oct 2022: 11 findings, 2 critical; 1 marked fixed, 7 acknowledged, 3 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Findings11
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 1 | 1 |
| High | 3 | 0 | 0 |
| Medium | 0 | 1 | 0 |
| Low | 0 | 5 | 0 |
CriticalPotential Logic Issue In `LootStaking `Fixed
In the function `_signalStake()`, token IDs are staked to the contract, in line 229 code the variable `epochsByNFTId[bagId]` stores `currentEpoch + 1`, so if the user stakes token IDs to the contract in the previous epoch, the condition `if (epochs[j] < currentEpoch)` in line 289 code returns false, the reward cannot be cumulative, and in line 300 the variable `epochs[epochsLength - 1]` stores a value that might be `currentEpoch + 1`.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (6)
- src/MLoot.sol
- src/lib/Math.sol
- src/AdventureGold.sol
- src/LootStaking.sol
- src/Loot.sol
- src/lib/Base64.sol
Part of Loot’s security record
LootSecurity firm
CertiK1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us