Paradox Meta

CertiK11 Nov 2022Files named in the report

CertiK reviewed Paradox Metaverse (Paradox Meta) on 11 Nov 2022: 18 findings, 2 critical; 8 marked fixed, 1 acknowledged, 9 open.

2 critical findings, fixed

Open the report Open Paradox Metaverse’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings18

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	2
High	0	1	0
Medium	1	0	1
Low	8	0	5

HighCentralization Related RisksAcknowledged

In the contract `NFT.sol`, the role `MINTER_ROLE` has authority over the following function(s): - function `safeMint()`, to mint a token for the target account or contract. AND The role `DEFAULT_ADMIN_ROle` has authority over the following function(s): - function `grantRole()` and `revokeRole()`, to grant a role to or revoke a role from the user. Any compromise to the privileged accounts may allow a hacker to take advantage of this authority and bring unpredictable damages to the project. In the contract `Paradox.sol`, the role `MINTER_ROLE` has authority over the following function(s): - function `mint()`, to mint tokens for an arbitrary address. AND The role `DEFAULT_ADMIN_ROLE` has authority over the following function(s): - function `grantRole()` and `revokeRole()`, to grant a role to or revoke a role from the user. Any compromise to the privileged accounts may allow a hacker to take advantage of this authority and bring unpredictable damages to the project. In the contract `StakePool.sol`, the role `DEFAULT_ADMIN_ROLE` has authority over the following function(s): - function `addPool()`, to add a reward pool. Any compromise to the privileged accounts may allow a hacker to take advantage of this authority and bring unpredictable damages to the project.