Carbify - NFT

QuillAudits11 May 2023Files named in the report

Audit · firm’s term: audit report

QuillAudits reviewed Business Carbify (Carbify - NFT) on 11 May 2023: 4 findings, 0 critical; all marked fixed.

No open critical findings

Open the report Open Business Carbify’s security record

Report hosted on quillaudits.com.

Trustblock does not review code.

Findings4

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	1
Medium	0	0	2
Low	0	0	1

High• Overlaping of tokenId indexes of NFTs would lead minting of NFT at same tokenId.Fixed

At NftreeFactory.sol#L151-152 incorrect firstIndex and lastIndex get calculated during ecoEmpire and backup initialization. ecoEmpire’s batch firstIndex and lastIndex is shortfall by 1 while backup’s batch firstIndex and lastIndex is shortfall by 2.Because of this overlapping of indexes ecoEmpire would mint its NFT at the lastIndex of Staking NFT similarly backup NFT get minted at ecoEmpire’s lastIndex.

Medium• Incorrect fees precedence.Fixed

At Nftree.sol#L220-221, In updateFees function fee1, fee2 & fee3 are set but all are validated against MAX_FEE i.e. fee1, fee2, fee3 <= MAX_FEE , It is a valid check but the updateFees should have additional check where it validates that MAX_FEE >= fee1 > fee2 > fee3 otherwise it will defeat the purpose of having different fees value for different period of deposit. E.g. paying more fee for keeping the deposit of CBY for 2 years compare to the deposit of 6 months.

Medium• Multiple deposits of CBY for a tokenId would lead to pay more fees by the users.Fixed

At Nftree.sol#L601, Deposit time is set as the block.timestamp, However, if the user deposits more tokens for a same tokenId after a year then user deposit timestamp get set as the latest deposit timestamp and user have to pay fee1 bracket even for the withdrawal of the early deposit amount. This would discourage the recurring deposits corresponds to a single tokenId.

Low• Micelleanous recommendation for the code cleanupFixed

At Nftree.sol#L236 & Nftree.sol#L249, Recommended to not use the require statement in the view functions instead return false & (false, 0) respectively. It would be better for the UX.