Baby Doge - NFT Farm

CertiKFiles named in the report

CertiK reviewed Baby Doge (Baby Doge - NFT Farm) on 2 Oct 2023: 12 findings, 0 critical; 10 marked fixed, 1 acknowledged, 1 open.

No open critical findings
Open the reportOpen Baby Doge’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings12

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High010
Medium001
Low109
MediumDefinition of depositOnBehalfFixed

The function `depositOnBehalf` calls `stakeToken.transferFrom` to send tokens from Msg.sender instead of the address `account`. Therefore the address `account` will receive the shares and the reward token instead of the message sender. Therefore the `account` must send tokens to Msg.sender before the Msg.sender calls `depositOnBehalf`. Otherwise the Msg.sender will lose their deposit tokens and previous rewards assuming Msg.sender and `account` are differing accounts. A similar issue can be found in `ERC20FarmFixed`, `ERC721FarmFixed`, and `ERC721Farm`.

LowComparison to Boolean ConstantFixed

Boolean constants can be used directly and do not need to be compared to true or false.

LowDifferent Solidity VersionsFixed

Multiple Solidity versions are used in the codebase. Versions used: `^0.8.11`, `^0.8.0`

LowLoss of Rewards from ReentrancyFixed

For the `ERC20Farm.sol` and `ERC20FarmedFixEnd.sol`, there is a minor risk of a user claiming double rewards via reentrancy. Consider the following scenario: 1. Suppose the stakeToken contains a hook to an external contract for recipient verification. 2. Further suppose that Bob controls a contract that deposits X stakeToken at block 0. 3. At Block 100, Bob's contract then calls withdraw function which transfers the stakeToken. 4. Bob's contract would be able to reenter deposit using the hook. This would allow Bob to collect rewards based on the `withdrawal` call and then the `deposit` call. This would be an issue for ERC721 if safeTransferFrom was used. Further, nonReentrant modifier will not protect against this attack.

LowMissing Zero Address ValidationFixed

Addresses should be checked before assignment or external call to make sure they are not zero addresses.

LowPotential Loss of Staked TokensFixed

When calling the `deposit` function there is a potential loss of staked tokens given the following scenario: 1. If the following statement is true: `_amount` > `defaultStakePPS` 2. If `depositedAmount` < `defaultStakePPS` is true where `depositedAmount` = `subsequentBalance` - `initialBalance` Then `user.shares` will not record an updated amount.

LowRequire Check TautologyFixed

The initial require statement of the `deposit()` function always checks that `_amount` is larger then zero. Therefore the fourth require statement is always true.

LowShadowing Local VariableFixed

The owner parameter is shadowing the function `owner` in `Ownable`.

LowUnlocked Compiler VersionFixed

The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to different compiler versions. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

LowUnused State VariableFixed

The `feeReceiver` are not used in `ERC721FarmFixEnd` and in `ERC721Farm`.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (10)

  • contracts/ERC721FarmFixEnd.sol
  • contracts/FarmDeployer20FixEnd.sol
  • contracts/FarmDeployer.sol
  • contracts/FarmDeployer20.sol
  • contracts/FarmDeployer721FixEnd.sol
  • contracts/IFarmDeployer.sol
  • contracts/ERC20FarmFixEnd.sol
  • contracts/ERC721Farm.sol
  • contracts/ERC20Farm.sol
  • contracts/FarmDeployer721.sol

Part of Baby Doge’s security record

Baby Doge
Audits2 audits by 1 firmLast audit Oct 2023, by CertiK.
Critical findingsNo open critical findingsAcross 2 reports.
Open Baby Doge’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us