CertiK reviewed Paradox Metaverse (Paradox Meta) on 11 Nov 2022: 18 findings, 2 critical; 8 marked fixed, 1 acknowledged, 9 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 1 | 0 |
| Medium | 1 | 0 | 1 |
| Low | 8 | 0 | 5 |
The staking rewards `payout` has been included in `stakeReturn`. While `usr.rewardDebt` is not updated to avoid multi claims.
The payout is calculated with `usr.stakeSharesTotal`. It should be based on the share of the stake. Otherwise, it is only relative to days. For example, user A stakes 1$ one year ago and stakes 100,000$ this year. He/She can claim the 1-year payout based on the total 100,001$.
The calculation of `rewardDebt` should be `userPosition.totalAmount * vPool.accParaPerShare` rather than `newStakedParas * vPool.accParaPerShare`. In the farming contract, each time the total amount changes, the staged reward must be stored and the reward debt should be updated to the latest `totalAmount * paraPershare`. So that the changing variable `amount` can be controlled to make the `accPerParaShare` the only changing variable to calculate rewards.
The cost of adding the share is to give up the old rewards (because the calculation of the `rewardDebt`). If the part of tokens give up the reward, and the rewards are released according to the total shares. So the actually claimed rewards may be different from the scheduled.
The mapping of `stakeIndex` to `stakeIdParam` should be checked in the function `endStake()` to ensure the target stake is the one that the caller want to end.
The function `_safeMint()` performs an external call, providing chance for potential reentrancy attacks. Better to move `_safeMint()` to the last of the functions.
The mentioned code can be directly changed to: ```Solidity=239 virtualPool.lastRewardTime = block.timestamp; ```
The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (4)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us