CertiK reviewed Centaurify (Centaurify - Genesis Mint) on 27 Sep 2022: 8 findings, 0 critical; 7 marked fixed, 1 acknowledged.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 0 | 7 |
There are several privileged roles within the contracts that control access to significant administrative functions. #### ADMIN_ROLE In the contract `GenesisStorage` the role `ADMIN_ROLE` has authority over the functions shown in the diagram and the list below: * setMerkleRoot() - Sets the Merkle root of the current phase * setMaxItemsPerTx() - Sets mint limit per transaction * setRecipient() - Sets recipient address * setOperator() - Sets new operator address * removeStuckTokens() - Moves stuck ERC20 tokens to specified address * setBaseTokenURI() - Sets `_baseTokenURI` * setContractURI() - Sets `_contractURI` * setURISuffix() - Sets `uriSuffix` * getMerkleRoot() - Gets current Merkle root * getRecipient() - Gets current recipient address * withdraw() - Withdraw contract Ether balance to recipient account * setTokenRoyalty() - Sets royalty structure for specific token ID * setDefaultRoyalty() - Sets default royalty structure Any compromise to the `ADMIN_ROLE` account may allow the hacker to take advantage of this authority to set up important operational roles and parameters, facilitate token transactions.  In the contract `GenesisMint` the role `ADMIN_ROLE` has authority over the function shown below: * ownerMint() - Mint tokens to a specified address Any compromise would allow the hacker to mint any amount of NFTs to a specified address while also overriding the transaction mint limit. #### OPERATOR_ROLE In the contract `GenesisStorage` the role `OPERATOR_ROLE` has authority over the functions shown in the diagram and the list below: * setPhaseOneMintValues() - Sets status to Premint Phase 1 * setPhaseTwoMintValues() - Sets status to Premint Phase 2 * setPhaseThreeMintValues() - Sets status to Premint Phase 3 * setPublicMintValues() - Sets status to Public Mint * setEarlyRevealValues() - Sets status to Early Reveal * setRevealValues() - Sets status to Revealed Any compromise to the `OPERATOR_ROLE` account may allow the hacker to take advantage of this authority to set up the different NFT sale phases. 
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (2)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us