CertiK reviewed Apeiron (ApeIron - Token Contract) on 11 Oct 2022: 34 findings, 3 critical; 20 marked fixed, 11 acknowledged, 3 open.
Report hosted on skynet.certik.com.
Statuses are the security firm’s own, from this report. Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 2 | 0 | 1 |
| High | 0 | 11 | 3 |
| Medium | 0 | 0 | 1 |
| Low | 1 | 0 | 15 |
Users can join an expedition by staking zero asset. This attack is only valid if expeditions share required planets and optional assets NFT. Attack flow: 1. call the function stakeNFTBeforeExpeditionEnd() to stake NFT. 2. call the function joinExpedition() to join an expedition. 3. call the function unstakeNFTBeforeExpeditionEnd() to unstake NFT by passing another `_expeditionId`.
Users can join multiple expeditions while only stake onetime. This attack is only valid if expeditions share required planets and optional assets NFT. Attack Flow: 1. call the function stakeNFTBeforeExpeditionEnd() to stake NFT. 2. call the function joinExpedition() to join an expedition. 3. call the function joinExpedition() to join another expedition. 4. call the function joinExpedition() to join another expedition. ...... 6. choose one that is most profitable to claim rewards.
One or more state variables are never used in the codebase. Variable `STATE_NOT_STARTED` in `ExpeditionMeta` is never used in `MockExpeditionPrizesV2`. ```solidity=12 uint256 internal constant STATE_NOT_STARTED = 0; ``` ```solidity=6 contract MockExpeditionPrizesV2 is ExpeditionPrizes { ``` --- Variable `STATE_STARTED` in `ExpeditionMeta` is never used in `MockExpeditionPrizesV2`. ```solidity=13 uint256 internal constant STATE_STARTED = 1; ``` ```solidity=6 contract MockExpeditionPrizesV2 is ExpeditionPrizes { ``` --- Variable `STATE_CLAIMABLE` in `ExpeditionMeta` is never used in `MockExpeditionPrizesV2`. ```solidity=15 uint256 internal constant STATE_CLAIMABLE = 3; ``` ```solidity=6 contract MockExpeditionPrizesV2 is ExpeditionPrizes { ``` --- Variable `PRIZE_TYPE_TRANSFER_NONE` in `ExpeditionPrizes` is never used in `MockExpeditionPrizesV2`. ```solidity=34 uint256 internal constant PRIZE_TYPE_TRANSFER_NONE = 0; ``` ```solidity=6 contract MockExpeditionPrizesV2 is ExpeditionPrizes { ```
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (20)
1,044 projects reviewed · 1,393 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us