ApeIron - Token Contract

CertiKFiles named in the report

CertiK reviewed Apeiron (ApeIron - Token Contract) on 11 Oct 2022: 34 findings, 3 critical; 20 marked fixed, 11 acknowledged, 3 open.

2 open critical findings
Open the reportOpen Apeiron’s security record

Report hosted on skynet.certik.com.

Statuses are the security firm’s own, from this report. Trustblock does not review code.

Findings34

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical201
High0113
Medium001
Low1015
CriticalUsers Can Join An Expedition By Staking Zero AsseNot fixed

Users can join an expedition by staking zero asset. This attack is only valid if expeditions share required planets and optional assets NFT. Attack flow: 1. call the function stakeNFTBeforeExpeditionEnd() to stake NFT. 2. call the function joinExpedition() to join an expedition. 3. call the function unstakeNFTBeforeExpeditionEnd() to unstake NFT by passing another `_expeditionId`.

CriticalUsers Can Join Multiple Expeditions While Only StNot fixed

Users can join multiple expeditions while only stake onetime. This attack is only valid if expeditions share required planets and optional assets NFT. Attack Flow: 1. call the function stakeNFTBeforeExpeditionEnd() to stake NFT. 2. call the function joinExpedition() to join an expedition. 3. call the function joinExpedition() to join another expedition. 4. call the function joinExpedition() to join another expedition. ...... 6. choose one that is most profitable to claim rewards.

LowUnused State VariableNot fixed

One or more state variables are never used in the codebase. Variable `STATE_NOT_STARTED` in `ExpeditionMeta` is never used in `MockExpeditionPrizesV2`. ```solidity=12 uint256 internal constant STATE_NOT_STARTED = 0; ``` ```solidity=6 contract MockExpeditionPrizesV2 is ExpeditionPrizes { ``` --- Variable `STATE_STARTED` in `ExpeditionMeta` is never used in `MockExpeditionPrizesV2`. ```solidity=13 uint256 internal constant STATE_STARTED = 1; ``` ```solidity=6 contract MockExpeditionPrizesV2 is ExpeditionPrizes { ``` --- Variable `STATE_CLAIMABLE` in `ExpeditionMeta` is never used in `MockExpeditionPrizesV2`. ```solidity=15 uint256 internal constant STATE_CLAIMABLE = 3; ``` ```solidity=6 contract MockExpeditionPrizesV2 is ExpeditionPrizes { ``` --- Variable `PRIZE_TYPE_TRANSFER_NONE` in `ExpeditionPrizes` is never used in `MockExpeditionPrizesV2`. ```solidity=34 uint256 internal constant PRIZE_TYPE_TRANSFER_NONE = 0; ``` ```solidity=6 contract MockExpeditionPrizesV2 is ExpeditionPrizes { ```

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (20)

  • contracts/ApeironGodiverseCollection.sol
  • contracts/APRSVesting.sol
  • contracts/utils/AccessProtectedUpgradable.sol
  • contracts/NebulaExpedition.sol
  • contracts/ExpeditionMeta.sol
  • contracts/interfaces/IApeironPlanet.sol
  • contracts/utils/AccessControlMixin.sol
  • contracts/StakeAssetMeta.sol
  • contracts/ANIMAroot.sol
  • contracts/ANIMA.sol
  • contracts/ANIMAchild.sol
  • contracts/interfaces/IApeironStar.sol
  • contracts/APRSroot.sol
  • contracts/interfaces/IApeironGodiverseCollection.sol
  • contracts/utils/IMintableERC20.sol
  • contracts/APRSchild.sol
  • contracts/ExpeditionPrizes.sol
  • contracts/ExpeditionStakingAndKeys.sol
  • contracts/utils/IChildToken.sol
  • contracts/utils/AccessProtected.sol

Part of Apeiron’s security record

Apeiron
Audits3 audits by 1 firmLast audit Nov 2022, by CertiK.
Critical findingsNo open critical findingsAcross 3 reports.
Open Apeiron’s security record

Security firm

CertiK

1,044 projects reviewed · 1,393 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us