Paradox Meta

CertiK11 Nov 2022Files named in the report

CertiK reviewed Paradox Metaverse (Paradox Meta) on 11 Nov 2022: 18 findings, 2 critical; 8 marked fixed, 1 acknowledged, 9 open.

2 critical findings, fixed

Open the report Open Paradox Metaverse’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings18

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	2
High	0	1	0
Medium	1	0	1
Low	8	0	5

MediumInitial Token DistributionOpen

1 billion tokens are sent to the contract deployer when deploying the contract. This could be a centralization risk as the deployer can distribute para tokens without obtaining the consensus of the community.

Low33% of staked para tokens sent to rewardsPoolOpen

33% of the staked para tokens are sent to the `rewardsPoolAddress`.

LowcappedExtraDays not cappedOpen

The variable `cappedExtraDays` is not capped with `LPB_D`.

LowFinancial ModelsOpen

The purpose of the contract `stakePool` is not clear. The development team should confirm that it is consistent with the original project design. And the financial model of this protocol is not in the scope of this audit.

LowImproper Usage of `public` and `external` TypeOpen

`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.

LowLogical issue about burning PARA tokenOpen

33% of the staked para tokens are burnt in the function stake(). It isn't aimed to decrease the total supply of para tokens to improve the price, because the reward token is also para token and the contract will return all 100% of the staked para tokens and rewards token. So the total supply of para token will be increased to cover every user's principal and rewards.

LowLogical issue of function `_removeStakeFromList()Open

The implementation of function `_removeStakeFromList()` will change the order of the list. So it should be noticed that the `stakeId` may get changed.

LowShare is part of rewardOpen

The payout is composed of the bonus part and the staking part. The bonus part is $actuallyStakedDays/scheduledStakedDAys * Share$. It's confusing that `Share` is not only represent for the user share to participate rewards distribution but also represent for the bonus rewards.

LowvirtualPool can be changedOpen

The `virtualPool` can be changed through function `addPool()`. It should not be changed because if the `accParaPerShare` is set to 0, all the reward calculations will be wrong.