Promotions
Paladin reviewed BetSwirl (Promotions) on 13 Dec 2024: 28 findings, 0 critical; 19 marked fixed, 7 acknowledged, 2 open.
Report hosted on paladinsec.co.
Trustblock does not review code.
Findings28
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 2 |
| Low | 2 | 7 | 17 |
MediumpullUnclaimedNFTs() can result in affiliates stealing NFTs which are re-deposited in future leaderboardsFixed
The report gives no description here.
MediumUse of safeIncreaseAllowance() can brick the FreeBet contract for tokens requiring 0 approvals prior to approving a non-zero amountFixed
The report gives no description here.
LowA VRF call is not needed when only one winner is determined during finalizationFixed
The report gives no description here.
LowAccounting of balances will not work for rebasing tokens or tokens with a fee on transferFixed
The report gives no description here.
LowAffiliate must wait for finalized leaderboard with no winners to expire in order to unclaimFixed
The report gives no description here.
LowAffiliate should not be address(0)Fixed
The report gives no description here.
LowAffiliates cannot unclaim any tokens if the leaderboard is not explicitly canceled or finalizedFixed
The report gives no description here.
LowDuplicate winner addresses in the winners_ array in finalizeLeaderboard() can result in overwriting winnerPositions mapping for a given winnerFixed
The report gives no description here.
LowEvent indexingFixed
The report gives no description here.
LowFee-on-transfer and rebasing tokens not supportedFixed
The report gives no description here.
Show 9 more
LowGas optimizationsFixed
The report gives no description here.
LowIncorrect validation for checking against the randomNFTsLimit in createLeaderboard()Fixed
The report gives no description here.
LowInsufficient validationFixed
The report gives no description here.
LowLack of upper limit on expirationTime, as well as unsafe casting when calculating expiresAt can break intended logicFixed
The report gives no description here.
LowLeaderboard manager cannot cancel leaderboardFixed
The report gives no description here.
LowTypographical issuesFixed
The report gives no description here.
LowUnsafe casting without prior validation in multiple cases, such as with winners and playerIndex in fulfillRandomWords()Fixed
The report gives no description here.
LowUsers can create leaderboards that end in the same blockFixed
The report gives no description here.
LowUsing unchecked for calculating totalShares in createLeaderboard() is unsafeFixed
The report gives no description here.
Contracts in scope10
| Address | Chain | Source code |
|---|---|---|
| 0x0e5c8ea20a1eb26e5dde5afab5279f546db92a79 | Chain: BNB Chain | Source code: Verified source |
| 0x0e5c8ea20a1eb26e5dde5afab5279f546db92a79 | Chain: Polygon (POS) | Source code: Verified source |
| 0x7a1efd33f41150e3247f14209b2a733bc6b1cb7a | Chain: BNB Chain | Source code: Verified source |
| 0x7a1efd33f41150e3247f14209b2a733bc6b1cb7a | Chain: Arbitrum | Source code: Verified source |
| 0x7a1efd33f41150e3247f14209b2a733bc6b1cb7a | Chain: Base | Source code: Verified source |
| 0x0e5c8ea20a1eb26e5dde5afab5279f546db92a79 | Chain: Arbitrum | Source code: Verified source |
| 0x7a1efd33f41150e3247f14209b2a733bc6b1cb7a | Chain: Polygon (POS) | Source code: Verified source |
| 0x0e5c8ea20a1eb26e5dde5afab5279f546db92a79 | Chain: Base | Source code: Verified source |
| 0x7a1efd33f41150e3247f14209b2a733bc6b1cb7a | Chain: Avalanche | Source code: Verified source |
| 0x0e5c8ea20a1eb26e5dde5afab5279f546db92a79 | Chain: Avalanche | Source code: Verified source |
Part of BetSwirl’s security record
BetSwirlSecurity firm
Paladin176 projects reviewed · 241 reports · latest Apr 2025
See Paladin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us