NettyWorth - Smart Contracts V3
CredShields reviewed NettyWorth (NettyWorth - Smart Contracts V3) on 14 Jul 2026: 40 findings, 8 critical; all marked fixed.
Report hosted on GitHub.
Trustblock does not review code.
Findings40
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 8 |
| High | 0 | 0 | 10 |
| Medium | 0 | 0 | 14 |
| Low | 0 | 0 | 8 |
CriticalAcquireDefaultedAsset credits totalDeposited without USDC arriving phantom liquidityFixed
The report gives no description here.
CriticalAssetNFT.batchBurn on Held-state collateral desyncs AssetLendingPool and P2PTradeEscrow accounting; loss is permanentFixed
The report gives no description here.
CriticalBuybackPool retroactive model switch (AmountSpent FMV + bearer fmv=1 quote) drains poolFixed
The report gives no description here.
CriticalDirect theft of user's NFTFixed
The report gives no description here.
CriticalDiscount + Buyback-boost promo code stack yields guaranteed profit per packFixed
The report gives no description here.
CriticalMarketplace's loan settlement branch skips listing-seller authorization anyone can force-sell any borrower's collateralFixed
The report gives no description here.
CriticalPackMachine.fulfillRandomness nested IBuybackPool.registerToken revert kills the VRF callback; user pays for a pack that is never deliveredFixed
The report gives no description here.
CriticalSigned auction cannot be revoked cancelNonce does not gate commitBid; leaked auction signature stays valid post cancellationFixed
The report gives no description here.
HighAssetLendingPool._collectOriginationFee live-read at disbursement; admin setOriginationFee front-run shrinks borrower's disbursement to zeroFixed
The report gives no description here.
HighAssetLendingPool.financeMarketplacePurchase skips listing.buyer enforcement private listing hijackFixed
The report gives no description here.
Show 10 more
HighAssetNFT.initiateShipment no maxFee slippage; admin setAppraisal front-run drains user's USDC approvalFixed
The report gives no description here.
HighBundle loan over-release marketplace sale of one token releases the entire collateral bundleFixed
The report gives no description here.
HighBuybackPool._executeBuyback FMV-quote nonce not reset on registerToken; leaked stale quote drains pool after model flipFixed
The report gives no description here.
HighbuyWithSignature SignedListing is a bearer instrument front-running steals private deals and griefs intended buyersFixed
The report gives no description here.
HighCross-Collection tokenId Collision latent collateral heist activates on multi-collection allowlistFixed
The report gives no description here.
HighFMV quote is a bearer instrument signer-binding never finishedFixed
The report gives no description here.
HighJust-in-time lender deposit sandwich on loan repaymentFixed
The report gives no description here.
HighSeller nonce cancellation asymmetry marketplace.cancelNonce burns only usedNonces, leaving pool.financeNonces redeemableFixed
The report gives no description here.
MediumAuction can be cancelled after a bidder commits griefing the bidder's gas + denying the NFTFixed
The report gives no description here.
MediumborrowerLoans array is append-only unbounded growth, no closing-path cleanupFixed
The report gives no description here.
Show 10 more
MediumBuybackPool pause silently strips buyback rights from every card won during the pause windowFixed
The report gives no description here.
MediumDefault forfeits all loan interest lenders and protocol get only principal backFixed
The report gives no description here.
MediumDiscount promo code is not scoped to a PackMachine cross-machine misuse + griefingFixed
The report gives no description here.
MediumfinanceMarketplacePurchase allows self-financing of pool's defaulted collateral DoS of default resolution + permanent accounting corruptionFixed
The report gives no description here.
MediumMarketplace allowlist setter has no compatibility canary fee-on-transfer token addition will brick settlementFixed
The report gives no description here.
MediumMutable lenderShareBps retroactively reprices in-flight loan interestFixed
The report gives no description here.
MediumNettyWorthMarketplace.hashAuction returns domain-separated hash but commitBid uses bare struct hash; documented API always failsFixed
The report gives no description here.
MediumPackMachine config setters not pause-gated race window between user payment and VRF callbackFixed
The report gives no description here.
MediumPackMachine.resetEffectivePrizePoolSize ignores in-flight VRF reservations; post-reset opens oversell inventory, later callbacks emit CardFailed(tokenId=0)Fixed
The report gives no description here.
MediumPackMachineFactory.beforeTransfer / .afterTransfer low-level .call() silently swallows validator reverts; selector 0x931820d7 does not match canonical CTSFixed
The report gives no description here.
Show 10 more
MediumStranded pack open VRF callback can fail and consume payment without delivering cards or refundFixed
The report gives no description here.
MediumTransfer-validator revert in PackMachine.fulfillRandomness permanently locks user USDC and stucks pool accountingFixed
The report gives no description here.
LowAssetLendingPool.setDefaultLifecycleConfig retroactive window change contradicts docstring; admin can flip phase for in-flight defaultsFixed
The report gives no description here.
LowBuybackPool _redeposit silently no-ops if source machine deregistered NFT stuck, payout already madeFixed
The report gives no description here.
LowBuybackPool._executeBuyback silently switched BuybackExecuted.payout and totalPaidOut from net to gross; off-chain integrators overstate user proceedsFixed
The report gives no description here.
LowBuybackPool.initializeV2 unprotected reinitializer(2); V2 slot front-runnableFixed
The report gives no description here.
Lowmissing zero-address check + non-pause-gated; pool unset silently disables buyback registrationFixed
The report gives no description here.
LowNettyWorthMarketplace._executeSale royalty deducted from seller proceeds but not paid when royaltyReceiver \== address(0); USDC strandedFixed
The report gives no description here.
LowoncePerUser discount code burnable by anyone with leaked OpenPack signatureFixed
The report gives no description here.
LowPackMachine.rescueERC20 can drain any ERC-20 balance admin foot-gunFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of NettyWorth’s security record
NettyWorthSecurity firm
CredShields45 projects reviewed · 58 reports · latest Oct 2026
See CredShields’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us