Memeland

CertiKFiles named in the report

CertiK reviewed Memecoin (Memeland) on 27 Nov 2023: 13 findings, 0 critical; 3 marked fixed, 3 acknowledged, 7 open.

No open critical findings
Open the reportOpen Memecoin’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings13

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High030
Medium001
Low702
LowCross-chain Reuse of SignatureOpen

The signature computed at the pointed lines does not include any information regarding the chain the contract is deployed to. In the case in which the `MemecoinFiresaleV1` contract is deployed on multiple blockchains, then the signatures used on one chain for a certain account, can be reused as-is on each chain where the contract is present.

LowLack Of Gap Can Lead To Incorrect UpgradeOpen

There is no storage gap preserved in the logic contract. Any logic contract that acts as a base contract that needs to be inherited by other upgradeable child should have a reasonable size of storage gap preserved for the new state variable introduced by the future upgrades.

LowMissing Emit EventsOpen

There should always be events emitted in the sensitive functions that are controlled by centralization roles or influence the contract state in a manner users should be aware of.

LowMissing Zero Address ValidationOpen

Addresses are not validated before assignment or external calls, potentially allowing the use of zero addresses and leading to unexpected behavior or vulnerabilities. For example, transferring tokens to a zero address can result in a permanent loss of those tokens. ```solidity=632 upgrader = _upgrader; ``` - `_upgrader` is not zero-checked before being used. --- ```solidity=156 signer = _signer; ``` - `_signer` is not zero-checked before being used. --- ```solidity=164 upgrader = _upgrader; ``` - `_upgrader` is not zero-checked before being used.

LowUnconstrained Claim Start TimestampOpen

The `_claimStartDate` parameter in the `depositClaimTokenAndStartClaim` method defines the timestamp at which users can start claiming tokens from the contract. Such parameter is only constrained to be greater than 0 and does not have any relationship with the contract deployment time. Therefore, the claim can be set by the contract owner to have started in the past, automatically unlocking an amount of token with no vesting period. We would like to understand from the development team if this logic conforms to the expected behavior.

LowUnconstrained State TransitionsOpen

At the pointed location, the function `setFiresaleState` allows the `owner` to change the state of the firesale. There is no constraint on what is the relation among states. In fact, the `owner` can pass from an `OPENING` state to a `NOT_STARTED` state, without first passing to the `FINISHING` state.

LowUsage of uint128Open

The code at the pointed lines performs multiplications between `uint128` and `uint256`, and between `uint128` and `uint64`. The final `uint256` is then casted to `uint128` through the `_toUint128` method.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (12)

  • contracts/firesale/lib/Errors.sol
  • contracts/claim/lib/Errors.sol
  • contracts/firesale/lib/Structs.sol
  • contracts/memecoin/Memecoin.sol
  • contracts/claim/lib/Structs.sol
  • contracts/firesale/MemecoinFiresaleV1.sol
  • contracts/claim/MemecoinMultiClaim.sol
  • contracts/claim/interfaces/IMemecoinClaim.sol
  • contracts/claim/interfaces/IERC721.sol
  • contracts/claim/MemecoinClaimV1.sol
  • contracts/firesale/interfaces/IMemecoinFiresale.sol
  • contracts/claim/MemecoinClaim.sol

Part of Memecoin’s security record

Memecoin
Audits1 audit by 1 firmLast audit Nov 2023, by CertiK.
Critical findingsNo open critical findingsIn 1 report.
Open Memecoin’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us