ShredN - Audit

CertiK18 Oct 2022Files named in the report

Audit

CertiK reviewed shredn (ShredN - Audit) on 18 Oct 2022: 11 findings, 0 critical; 1 acknowledged, 10 open.

No open critical findings

Open the report Open shredn’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings11

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged
Critical	0	0
High	0	1
Medium	0	0
Low	10	0

LowCheck Effect Interaction Pattern ViolatedOpen

The order of external call/transfer and storage manipulation must follow the check-effect-interaction pattern.

LowFinancial ModelsOpen

The `ERC721GalaxyPair` equalizes the value of all NFTs, which may be contrary to the concept of NFT itself.

LowHardcoded interface idOpen

Hard-coded interface id should never be used to avoid unpredictable errors.

LowLogical issue about `supportsInterface`Open

The contract `ERC1155Pair` implements the interface `IERC1155Receiver` but always returns false in the function `supportsInterface`. So is the contract `ERC721GalaxyPair`.

LowMissing check for amountOpen

The mentioned functions do not check if `amount == 0`. If `amount == 0`, no operation should be performed.

LowMissing Input ValidationOpen

The given input is missing the check for the non-zero address.

LowUnknown Implementation of GalaxyERC721Open

The contract is serving as the underlying entity to interact with GalaxyERC721 protocols. The implementation is not found in the audit scope. The scope of the audit treats it as a black box and assumes its functional correctness.

LowVariable could be declared as `constant`Open

Variable `rate` is not initialized in constructor and has a default value 1000. It could be declared as constant since it's never changed.

LowVariable Declare as ImmutableOpen

The variable `owner` assigned in the constructor can declare with `Immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since will not be stored in storage. Still, values will directly insert the values into the runtime code.

LowVariable initialized but not usedOpen

The variables `nftAmount` and `uri` of the struct `PairInfo` are initialized when pair created, but not updated after then.