Apeiron - Sanctuary Contract

CertiK4 Nov 2022Files named in the report

CertiK reviewed Apeiron (Apeiron - Sanctuary Contract) on 4 Nov 2022: 5 findings, 0 critical; 1 marked fixed, 4 acknowledged.

No open critical findings

Open the report Open Apeiron’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings5

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	0	0
High	4	0
Medium	0	0
Low	0	1

HighCentralization Risks in ApeironPlanet.solAcknowledged

In the contract `ApeironPlanet` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and burn all NFTs by calling the function `burn()`. ![](https://accelerator-tasks-prod.acc.corp.certik.com/d7ab32c1d8ff47a38461659ae7b70fae/diagrams/centralization_ApeironPlanet-ApeironPlanet-_owner.svg)

HighCentralization Risks in ApeironPlanetPresaleFactoAcknowledged

In the contract `ApeironPlanetPresaleFactory` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and withdraw all funds by calling the function withdrawFunds(). ![](https://accelerator-tasks-prod.acc.corp.certik.com/d7ab32c1d8ff47a38461659ae7b70fae/diagrams/centralization_ApeironPlanetPresaleFactory-ApeironPlanetPresaleFactory-_owner.svg)

HighCentralization Risks in BreedPlanet.solAcknowledged

In the contract `BreedPlanet` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and set the prices of token Aprs and token Anima to zero. ![](https://accelerator-tasks-prod.acc.corp.certik.com/d7ab32c1d8ff47a38461659ae7b70fae/diagrams/centralization_BreedPlanet-BreedPlanet-_owner.svg)

HighCentralized Control of Contract UpgradeAcknowledged

Since these contracts are upgradeable, the owner can upgrade the contract without the community's consent. If an attacker compromises the account, he/she can change the implementation of the contract and drain tokens from the contract.