CertiK reviewed The Sandbox (Sandbox V3) on 19 May 2020: 7 findings, 1 critical; 2 marked fixed, 5 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 0 |
| Low | 5 | 0 | 0 |
The functions “buyLandWithSand”, “buyLandWithETH”, “buyLandWithDAI” don’t check whether the input referral has been processed hence we need to be sure that an unauthorized user cannot call these functions more than the intended number of times.
In the function “buyLandWithETH” it can happen that “msg.sender” is a contract, hence “msg.sender.transfer(msg.sender - ETHRequired)” would trigger the receive or fallback function and can lead to revert. Nowaday “.transfer” only forwards 2300 gas, hence reentrancy is not a threat here.
The function `_checkAdjacency` always checks the adjacency of each newly added quad towards the last quad in the estate. Because of this the respective junction is left out which makes the junctions and quad lists unequal in length and usage of “_checkAdjacency” unintuitive
The function “approve” cannot be used by “_metaTransactionContracts” even though it is allowed in “approveFor” and we can just set “sender” to be the owner of the estate in “approveFor” to have the same effect for “approve”.
The implementation of “check_burn_authorized” , “check_add_authorized” and “check_create_authorized” indicates that Meta Transaction Contract, Superoperators, Operators for all, Operators, or even the owners of the estates are deprived of respective burning, adding, creating rights whenever a fixed global minter or breaker are set. Is this behaviour intended?
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (10)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us