Sandbox V3

CertiKFiles named in the report

CertiK reviewed The Sandbox (Sandbox V3) on 19 May 2020: 7 findings, 1 critical; 2 marked fixed, 5 open.

1 critical finding, fixed
Open the reportOpen The Sandbox’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings7

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical001
High001
Medium000
Low500
LowRepeated function callsOpen

The functions “buyLandWithSand”, “buyLandWithETH”, “buyLandWithDAI” don’t check whether the input referral has been processed hence we need to be sure that an unauthorized user cannot call these functions more than the intended number of times.

LowUnchecked scenarioOpen

In the function “buyLandWithETH” it can happen that “msg.sender” is a contract, hence “msg.sender.transfer(msg.sender - ETHRequired)” would trigger the receive or fallback function and can lead to revert. Nowaday “.transfer” only forwards 2300 gas, hence reentrancy is not a threat here.

LowUnclear codeOpen

The function `_checkAdjacency` always checks the adjacency of each newly added quad towards the last quad in the estate. Because of this the respective junction is left out which makes the junctions and quad lists unequal in length and usage of “_checkAdjacency” unintuitive

LowUnclear requirementOpen

The function “approve” cannot be used by “_metaTransactionContracts” even though it is allowed in “approveFor” and we can just set “sender” to be the owner of the estate in “approveFor” to have the same effect for “approve”.

LowUnclear requirementOpen

The implementation of “check_burn_authorized” , “check_add_authorized” and “check_create_authorized” indicates that Meta Transaction Contract, Superoperators, Operators for all, Operators, or even the owners of the estates are deprived of respective burning, adding, creating rights whenever a fixed global minter or breaker are set. Is this behaviour intended?

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (10)

  • src/EstateSale/LandToken.sol
  • src/Estate/EstateBaseToken.sol
  • src/ReferralValidator/ReferralValidator.sol
  • src/EstateSale/EstateSale.sol
  • src/Estate.sol
  • src/BaseWithStorage/ERC721BaseToken.sol
  • src/metatx/MetaTxWrapper.sol
  • src/TheSandbox712.sol
  • src/P2PERC721Sale/P2PERC721Sale.sol
  • src/Interfaces/LandToken.sol

Part of The Sandbox’s security record

The Sandbox
Audits8 audits by 2 firmsLast audit Aug 2023, by OpenZeppelin.
Critical findingsNo open critical findingsAcross the 8 reports, 1 critical finding was reported. It is marked fixed by the firm that reported it.
Open The Sandbox’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us