NvirWorld - Audit

CertiK30 Jan 2024Files named in the report

CertiK reviewed NvirWorld (NvirWorld - Audit) on 30 Jan 2024: 16 findings, 2 critical; 12 marked fixed, 2 acknowledged, 2 open.

2 critical findings, fixed

Open the report Open NvirWorld’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings16

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	2
High	0	2	0
Medium	0	0	3
Low	2	0	7

HighCentralization Risks in Launchpad.solAcknowledged

In the contract `NvirLaunchpad` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority to take out all the tokens in the contract. ![](https://accelerator-tasks-prod.acc.corp.certik.com/11ee-b8fa-97ef6f10-b92c-0ba3dfb583f8/diagrams/centralization_Launchpad-NvirLaunchpad-_owner.svg) In the contract `NvirLaunchpad` the role `saleWhitelist` has authority over the functions shown in the diagram below. Any compromise to the `saleWhitelist` account may allow the hacker to take advantage of this authority to buy tokens. ![](https://accelerator-tasks-prod.acc.corp.certik.com/11ee-b8fa-97ef6f10-b92c-0ba3dfb583f8/diagrams/centralization_Launchpad-NvirLaunchpad-saleWhitelist.svg)

HighInitial Token DistributionAcknowledged

All of the tokens are sent to the contract deployer. This is a centralization risk because the deployer or the owner(s) of the EOAs can distribute tokens without obtaining the consensus of the community. Any compromise to these addresses may allow a hacker to steal and sell tokens on the market, resulting in severe damage to the project.