Chill

CertiK17 Oct 2022Files named in the report

Audit

CertiK reviewed Chill on 17 Oct 2022: 10 findings, 0 critical; 6 marked fixed, 3 acknowledged, 1 open.

No open critical findings

Open the report Open Chill’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings10

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	3	0
Medium	0	0	1
Low	1	0	5

HighCentralization Risks in `SDD.sol`, `ERC721.sol` aAcknowledged

In the contract `SDD` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and mint themself any amount of tokens. ![](https://accelerator-tasks-prod.acc.corp.certik.com/c91d66d157204b9090ada4973dc21266/diagrams/centralization_SDD-SDD-_owner.svg) ---- In the contract `NFT` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and mint themself an NFT and as well change the basepoint URI which will lead to tokens to point to different metadata ![](https://accelerator-tasks-prod.acc.corp.certik.com/c91d66d157204b9090ada4973dc21266/diagrams/centralization_ERC721-NFT-_owner.svg) ---- In the contract `AiWatchNFT` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and mint themself an NFT and as well change the basepoint URI which will lead to tokens to point to different metadata which will lead to NFT's holding incorrect metadata. ![](https://accelerator-tasks-prod.acc.corp.certik.com/c91d66d157204b9090ada4973dc21266/diagrams/centralization_AiWatch-AiWatchNFT-_owner.svg)

HighCentralization Risks in XDD.solAcknowledged

In the contract `XDD` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and mint themself as many tokens as they please. 1. The hacker calls the function `setPrivateLockAddr()` and sets their percent to 100000. 2. Call the function `setPrivateUnLocks` and pass 0,1 to it. So the call is `setPrivateUnLockTs(0,1)`. 3. Call `claimPrivateUnLockFunds` until their claimed amount is 100% of what they can receive. 4. Transfer ownership to their other address and repeat the hack. ![](https://accelerator-tasks-prod.acc.corp.certik.com/c91d66d157204b9090ada4973dc21266/diagrams/centralization_XDD-XDD-_owner.svg)

HighCentralized Control of Contract UpgradeAcknowledged

[XDD] are upgradeable contracts, the owner can upgrade the contract without the community's commitment. If an attacker compromises the account, he can change the implementation of the contract and drain tokens from the contract.