CertiK reviewed The Sandbox (SandBox V4) on 19 Aug 2020: 36 findings, 0 critical; 24 marked fixed, 12 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 1 | 0 | 0 |
| Low | 11 | 0 | 24 |
The function “_firstBytes32” between L123 and L127 is a leftover function of the previous iteration whereby the “_name” and “_symbol” variables were of type “bytes32”.
Throughout the codebase, there are numerous instances where variables are checked using the GT operator against zero. This check costs more gas than simply conducting a not-equal operator with zero which achieves the same purpose.
The “storage” assignments of the aforementioned lines update all the fields of the “CatalystStored” struct at the specific index. Individually, each assignment needs to conduct specialized padding operations that increase their gas cost and conducts a full 256-bit update on storage.
The “CatalystMinter.sol” contract is utilizing the “SafeMathWithRequire” library whereas the “ERC20SubToken.sol” contract is utilizing the “SafeMath” library directly.
This library is meant to replicate the exact statements of the “SafeMath” library albeit with “require” statements rather than “assert” statements. The re-implementation is correct barring for the “div” implementation which does not “require” that “b” is different from zero.
The function of “CatalystDataBase” is called “_setMindData” whereby it interacts with minting data.
The declaration on L315 assigns a struct of the in-memory array of structs to an in-memory variable that is subsequently accessed by the line below it.
The aforementioned “require” calls rely on data that is accessible earlier than their invocations.
The conditional check of the “getValues” function checks whether the value of a gem ID is zero and if so, computes it and assigns it to the “values” array. If it is non-zero, however, the value literal “25” is assigned instead of the actual “valuesPerGemIds” value.
The “require” call of the specified line checks whether the “msg.sender” is a minter, however the error message in case the check fails is “NOT_AUTHORIZED_ADMIN”.
It is generally a widespread coding practice to store the maximum of an “uint256” to a “constant” contract variable if it is meant to be utilized across multiple segments of the code.
The specified line contains the magic number “0xFFfFfFffFFfffFFfFFfFFFFFffFFFffffFfFFFfF” which is meant to represent the address that triggers a “burn” instead of a “transfer” transaction.
The mapping lookups conducted in “_batchMint”, “batchTransferFrom” and “_batchBurnFrom” can be stored to an in-memory storage variable to optimize the gas cost of the functions significantly.
The function “addCatalysts” internally replicates the statements of “addCatalyst”.
The struct “CatalystData” contains a “uint16 maxGems” variable that is never read from and only assigned as a side-effect of “_setMintData”.
The return statement of L131 can be safely omitted as the named return variable is utilized within.
When a variable is declared in Solidity it possesses a default value, usually equal to zero. As such, assignments of this default value to declared variables are unnecessary.
The “Admin.sol” contract multiple contracts of the scope inherit from provides methods via which a contract's administrator is maintained. This contract exposes an “onlyAdmin” modifier that makes sure the “msg.sender” is equal to the “_admin” of the contract, however this check is manually carried out in multiple segments of the codebase.
The contract at hand stores the “_name” and “_symbol” of an ERC-20 contract in raw “bytes32” format rather than a “string” format directly and consequently converts these raw byte formats to a “string” format in the corresponding getter functions of the variables.
The documentation of L103 indicates that code should never reach this point.
A safe mathematics library is utilized throughout the codebase called “SafeMathWithRequire” except for the specified line whereby an unsafe addition is done with the result of a safe multiplication.
The “decimals” function of the above lines returns the value literal of “0” casted to a “uint8”.
The visibility specifiers of L113 and L114 & L146 and L147 are missing on CatalystDataBase and ERC20SubToken respectively.
Visibility specifiers are missing in the aforementioned lines that contain contract-level variable declarations.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (26)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us