Xterio

QuillAudits31 Mar 2023Files named in the report

Audit · firm’s term: audit report

QuillAudits reviewed Xterio Games (Xterio) on 31 Mar 2023: 2 findings, 0 critical; all marked fixed.

No open critical findings

Open the report Open Xterio Games’s security record

Report hosted on quillaudits.com.

Trustblock does not review code.

Findings2

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	1
Medium	0	0	0
Low	0	0	1

HighMalicious user can replay the signatures.Fixed

At Badge.sol#L155 and XSoul.sol#L84, In claimBadge and claimXSoul function respectively. Offchain computed signature is provided that does not have any expiry or nonce which would allow the recipient to re-use the same signature to mint the badge or a xSoul, While it would be a success only when the malicious user’s badge get revoked then user is free to re-use the same signature to mint the new badge. Similarly for xSoul, If it get removed or burned from user wallet then user can re-use the same signature to mint the xSoul.

LowMissing sanity check on expiry during setting user.Fixed

setUser function is used to set the user with given expiry value. However, In current implementation expiry value does not get validated before setting the user. Because of this an expired user can be added which causes confusion at offchain indexers when those indexers curates UpdateUser event