Sandbox V3
CertiK reviewed The Sandbox (Sandbox V3) on 19 May 2020: 7 findings, 1 critical; 2 marked fixed, 5 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Findings7
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 0 |
| Low | 5 | 0 | 0 |
CriticalFunction’s visibilityFixed
The function “_burn” ’s visibility is public. For a certain owner anyone can call this function by setting the same input for “from” and “owner”, hence burn the estate.
HighUnchecked variable stateFixed
The function “_ownerAndOperatorEnabledOf” returns the owner of an estate and whether an operator for the estate has been set. When an estate is burnt by “_burn” the value “_owners[id]” is not set to “0” but still tracks the last owner by setting the 161-th digit to “1”. The function “_ownerAndOperatorEnabledOf” does not consider this and would return the last owner even though the estate has already been burnt.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (10)
- src/EstateSale/LandToken.sol
- src/Estate/EstateBaseToken.sol
- src/ReferralValidator/ReferralValidator.sol
- src/EstateSale/EstateSale.sol
- src/Estate.sol
- src/BaseWithStorage/ERC721BaseToken.sol
- src/metatx/MetaTxWrapper.sol
- src/TheSandbox712.sol
- src/P2PERC721Sale/P2PERC721Sale.sol
- src/Interfaces/LandToken.sol
Part of The Sandbox’s security record
The SandboxSecurity firm
CertiK1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us