SandBox V4

CertiKFiles named in the report

CertiK reviewed The Sandbox (SandBox V4) on 19 Aug 2020: 36 findings, 0 critical; 24 marked fixed, 12 open.

No open critical findings
Open the reportOpen The Sandbox’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings36

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium100
Low11024
LowDead CodeFixed

The function “_firstBytes32” between L123 and L127 is a leftover function of the previous iteration whereby the “_name” and “_symbol” variables were of type “bytes32”.

LowGreater-than “>” Comparisons w/ ZeroFixed

Throughout the codebase, there are numerous instances where variables are checked using the GT operator against zero. This check costs more gas than simply conducting a not-equal operator with zero which achieves the same purpose.

LowGroup Assignments to StructFixed

The “storage” assignments of the aforementioned lines update all the fields of the “CatalystStored” struct at the specific index. Individually, each assignment needs to conduct specialized padding operations that increase their gas cost and conducts a full 256-bit update on storage.

LowInconsistent Library UtilizationFixed

The “CatalystMinter.sol” contract is utilizing the “SafeMathWithRequire” library whereas the “ERC20SubToken.sol” contract is utilizing the “SafeMath” library directly.

LowIncorrect “SafeMathWithRequire” ImplementationFixed

This library is meant to replicate the exact statements of the “SafeMath” library albeit with “require” statements rather than “assert” statements. The re-implementation is correct barring for the “div” implementation which does not “require” that “b” is different from zero.

LowIncorrect Function NameFixed

The function of “CatalystDataBase” is called “_setMindData” whereby it interacts with minting data.

LowInefficient Memory-to-Memory CopyFixed

The declaration on L315 assigns a struct of the in-memory array of structs to an in-memory variable that is subsequently accessed by the line below it.

LowInefficient Order of “require” CallsFixed

The aforementioned “require” calls rely on data that is accessible earlier than their invocations.

LowInexplicable Value LiteralFixed

The conditional check of the “getValues” function checks whether the value of a gem ID is zero and if so, computes it and assigns it to the “values” array. If it is non-zero, however, the value literal “25” is assigned instead of the actual “valuesPerGemIds” value.

LowInvalid “require” MessageFixed

The “require” call of the specified line checks whether the “msg.sender” is a minter, however the error message in case the check fails is “NOT_AUTHORIZED_ADMIN”.

Show 10 more
LowLiteral to ConstantFixed

It is generally a widespread coding practice to store the maximum of an “uint256” to a “constant” contract variable if it is meant to be utilized across multiple segments of the code.

LowMagic Number UtilizationFixed

The specified line contains the magic number “0xFFfFfFffFFfffFFfFFfFFFFFffFFFffffFfFFFfF” which is meant to represent the address that triggers a “burn” instead of a “transfer” transaction.

LowMapping Lookup OptimizationFixed

The mapping lookups conducted in “_batchMint”, “batchTransferFrom” and “_batchBurnFrom” can be stored to an in-memory storage variable to optimize the gas cost of the functions significantly.

LowNested Duplicate Code SegmentsFixed

The function “addCatalysts” internally replicates the statements of “addCatalyst”.

LowPotentially Ignored Struct MemberFixed

The struct “CatalystData” contains a “uint16 maxGems” variable that is never read from and only assigned as a side-effect of “_setMintData”.

LowRedundant ReturnFixed

The return statement of L131 can be safely omitted as the named return variable is utilized within.

LowRedundant Value AssignmentFixed

When a variable is declared in Solidity it possesses a default value, usually equal to zero. As such, assignments of this default value to declared variables are unnecessary.

LowSubstitution of “require” Calls w/ ModifierFixed

The “Admin.sol” contract multiple contracts of the scope inherit from provides methods via which a contract's administrator is maintained. This contract exposes an “onlyAdmin” modifier that makes sure the “msg.sender” is equal to the “_admin” of the contract, however this check is manually carried out in multiple segments of the codebase.

LowUnconventional “_name” and “_symbol” StorageFixed

The contract at hand stores the “_name” and “_symbol” of an ERC-20 contract in raw “bytes32” format rather than a “string” format directly and consequently converts these raw byte formats to a “string” format in the corresponding getter functions of the variables.

LowUnreachable StatementFixed

The documentation of L103 indicates that code should never reach this point.

Show 4 more
LowUnsafe Math AdditionFixed

A safe mathematics library is utilized throughout the codebase called “SafeMathWithRequire” except for the specified line whereby an unsafe addition is done with the result of a safe multiplication.

LowValue Literal “pure” Function ImplementationFixed

The “decimals” function of the above lines returns the value literal of “0” casted to a “uint8”.

LowVisibility Specifiers MissingFixed

The visibility specifiers of L113 and L114 & L146 and L147 are missing on CatalystDataBase and ERC20SubToken respectively.

LowVisibility Specifiers MissingFixed

Visibility specifiers are missing in the aforementioned lines that contain contract-level variable declarations.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (26)

  • src/Interfaces/AssetToken.sol
  • src/EstateSale/LandToken.sol
  • src/Estate/EstateBaseToken.sol
  • src/BaseWithStorage/wip/MintableERC1155Token.sol
  • src/Catalyst/GemToken.sol
  • src/ReferralValidator/ReferralValidator.sol
  • src/EstateSale/EstateSale.sol
  • src/Estate.sol
  • src/BaseWithStorage/ERC20SubToken.sol
  • src/CatalystRegistry.sol
  • src/Catalyst/CatalystDataBase.sol
  • src/BaseWithStorage/wip/ERC20BaseToken.sol
  • src/BaseWithStorage/ERC721BaseToken.sol
  • src/metatx/MetaTxWrapper.sol
  • src/Base/TheSandbox712.sol
  • src/Interfaces/ERC20Extended.sol
  • src/BaseWithStorage/wip/ERC1155BaseToken.sol
  • src/P2PERC721Sale/P2PERC721Sale.sol
  • src/Catalyst/ERC20GroupGem.sol
  • src/CatalystMinter.sol
  • src/Interfaces/LandToken.sol
  • src/BaseWithStorage/ERC20Group.sol
  • src/Catalyst/CatalystToken.sol
  • src/Catalyst/ERC20GroupCatalyst.sol
  • src/Catalyst/wip/ERC1155Catalyst.sol
  • src/Catalyst/wip/ERC1155Gem.sol

Part of The Sandbox’s security record

The Sandbox
Audits8 audits by 2 firmsLast audit Aug 2023, by OpenZeppelin.
Critical findingsNo open critical findingsAcross the 8 reports, 1 critical finding was reported. It is marked fixed by the firm that reported it.
Open The Sandbox’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us