LiveArtX-Ⅱ

CertiK20 Sep 2022Code version: not recorded (see the report)

Audit

CertiK reviewed LiveArtX (LiveArtX-Ⅱ) on 20 Sep 2022: 13 findings, 0 critical; 2 marked fixed, 3 acknowledged, 8 open.

No open critical findings

Open the report Open LiveArtX’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings13

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	2	0
Medium	0	1	0
Low	8	0	2

HighCentralization Risks in MetaMorphic.solAcknowledged

In the contract `MetaMorphic` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and set the address `beneficiary` to a different address, change `startTime1` and `startTime2` to 0 so the minting functions cannot be used, or reset the selling price. ![](https://accelerator-tasks-prod.acc.corp.certik.com/b8861ef43ced41a496026d2f0725a3d2/diagrams/centralization_MetaMorphic-MetaMorphic-_owner.svg)

HighCentralized Control of Contract UpgradeAcknowledged

`MetaMorphic` is an upgradeable contract; the owner can upgrade the contract without the community's consent. If an attacker compromises the account, they can change the implementation of the contract and drain tokens from the contract.

MediumImplementation contract is not initialized automaAcknowledged

When an implementation contract is deployed and the function `initialize()` is called from the proxy contract, it will execute in the context of the proxy contract storage. Hence the state variable `_initialized` and `_initializing` will be 0 and false, respectively. Attackers can directly call the function `initialize()` in the context of the implementation's storage, and feed in malicious inputs which can, in turn, affect the proxy.