Seed - Audit

CertiK1 address on BNB Chain

CertiK reviewed Seed.Photo (Seed - Audit) on 26 Dec 2023: 6 findings, 0 critical; 3 marked fixed, 3 open.

No open critical findings
Open the reportOpen Seed.Photo’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings6

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High101
Medium000
Low202
HighCentralization Risks in SEED.solFixed

In the contract `Ownable` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and do the following: - `renounceOwnership()`, maliciously give up the ownership. - `transferOwnership()`, maliciously transfer ownership to any account. ![](https://accelerator-tasks-prod.acc.corp.certik.com/11ee-9135-49d5b2e0-b07d-fb607f319de8/diagrams/centralization_SEED-Ownable-_owner.svg) In the contract `SEED` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and do the following: - `freezeAccount()`, maliciously protect any valid address from transferring assets. - `thawedAccount()`, maliciously allow any invalid address to transfer assets. ![](https://accelerator-tasks-prod.acc.corp.certik.com/11ee-9135-49d5b2e0-b07d-fb607f319de8/diagrams/centralization_SEED-SEED-_owner.svg)

LowPull-Over-Push Pattern In `transferOwnership()` FFixed

The change of `_owner` by function `transferOwnership()` overrides the previously set `_owner` with the new one without guaranteeing the new `_owner` is able to actuate transactions on-chain.

LowThe Frozen Accounts Can Receive SEEDFixed

According to the code logic of `_beforeTokenTransfer()` function, we know that the frozen accounts just cannot transfer token, but they can still receive token from others. ```solidity=658 function _beforeTokenTransfer(address from, address to, uint256 amount) internal virtual override(ERC20) { require(!frozenAccounts[from], "Frozen Account Can not Transfer Token,Please Contact the Support Team!"); super._beforeTokenTransfer(from, to, amount); } ```

Contracts in scope1

AddressChainSource code
0x6730f7a6bbb7b9c8e60843948f7feb4b6a17b7f7Chain: BNB ChainSource code: Verified source

Part of Seed.Photo’s security record

Seed.Photo
Audits2 audits by 2 firmsLast audit Jan 2024, by Cyberscope.
Critical findingsNo open critical findingsAcross 2 reports.
Open Seed.Photo’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us