Paradox Meta

CertiKFiles named in the report

CertiK reviewed Paradox Metaverse (Paradox Meta) on 11 Nov 2022: 18 findings, 2 critical; 8 marked fixed, 1 acknowledged, 9 open.

2 critical findings, fixed
Open the reportOpen Paradox Metaverse’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings18

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical002
High010
Medium101
Low805
CriticalFunction `endStake()` does not update `usr.rewardFixed

The staking rewards `payout` has been included in `stakeReturn`. While `usr.rewardDebt` is not updated to avoid multi claims.

CriticalLogical issue about payoutFixed

The payout is calculated with `usr.stakeSharesTotal`. It should be based on the share of the stake. Otherwise, it is only relative to days. For example, user A stakes 1$ one year ago and stakes 100,000$ this year. He/She can claim the 1-year payout based on the total 100,001$.

MediumWrong calculation of `rewardDebt`Fixed

The calculation of `rewardDebt` should be `userPosition.totalAmount * vPool.accParaPerShare` rather than `newStakedParas * vPool.accParaPerShare`. In the farming contract, each time the total amount changes, the staged reward must be stored and the reward debt should be updated to the latest `totalAmount * paraPershare`. So that the changing variable `amount` can be controlled to make the `accPerParaShare` the only changing variable to calculate rewards.

LowLogical issue of function `stake()`Fixed

The cost of adding the share is to give up the old rewards (because the calculation of the `rewardDebt`). If the part of tokens give up the reward, and the rewards are released according to the total shares. So the actually claimed rewards may be different from the scheduled.

LowMissing Input ValidationFixed

The mapping of `stakeIndex` to `stakeIdParam` should be checked in the function `endStake()` to ensure the target stake is the one that the caller want to end.

LowPotential Reentrancy due to `_safeMint()`Fixed

The function `_safeMint()` performs an external call, providing chance for potential reentrancy attacks. Better to move `_safeMint()` to the last of the functions.

LowRedundant variable `lastRewardTime`Fixed

The mentioned code can be directly changed to: ```Solidity=239 virtualPool.lastRewardTime = block.timestamp; ```

LowVariables That Could Be Declared as ImmutableFixed

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (4)

  • Paradox.sol
  • NFT.sol
  • Utilities.sol
  • StakePool.sol

Part of Paradox Metaverse’s security record

Paradox Metaverse
Audits1 audit by 1 firmLast audit Nov 2022, by CertiK.
Critical findingsNo open critical findingsIn that report, 2 critical findings were reported. Each is marked fixed by the firm that reported it.
Open Paradox Metaverse’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us