Wemix Retainer 141 GameServerNFT

CertiKFiles named in the report

Audit

Part of CertiK’s retainer series

CertiK reviewed WEMIX (Wemix Retainer 141 GameServerNFT) on 15 Nov 2024: 5 findings, 0 critical; 2 marked fixed, 3 open.

No open critical findings
Open the reportOpen WEMIX’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings5

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High201
Medium000
Low101
HighCentralization Ralated RisksOpen

In the contract `GameServerNftBaseV1`, the role `GAME_SERVER_ADMIN` has authority over the functions shown in the diagram below. Any compromise to the `GAME_SERVER_ADMIN` account may allow the hacker to take advantage of this authority and update token metadata, as well as mint NFT with metadata URI internally. ![](https://accelerator-tasks-prod.acc.corp.certik.com/11ef-9c7a-a484e250-bc3d-d5c3f44a65b3/diagrams/centralization_GameServerNftBaseV1-GameServerNftBaseV1-GAME_SERVER_ADMIN.svg) In the contract `GameServerNftBaseV1`, the role `GAME_SERVER_SUPER_ADMIN` has authority over the functions shown in the diagram below. Any compromise to the `GAME_SERVER_SUPER_ADMIN` account may allow the hacker to take advantage of this authority and mint NFTs, set token URI, and update token metadata URI. ![](https://accelerator-tasks-prod.acc.corp.certik.com/11ef-9c7a-a484e250-bc3d-d5c3f44a65b3/diagrams/centralization_GameServerNftBaseV1-GameServerNftBaseV1-GAME_SERVER_SUPER_ADMIN.svg)

HighCentralized Control of Contract UpgradeOpen

In the contract `GameServerNFTBaseV1`, the role `admin` has the authority to update the implementation contract behind the proxy contract contract. Any compromise to the `admin` account may allow a hacker to take advantage of this authority and change the implementation contract which is pointed by proxy and therefore execute potential malicious functionality in the implementation contract.

LowStorage Size ConventionOpen

While not a requirement, generally each upgradeable contract contains 50 storage slots in total, including already used storage slots. In the `GameServerNftBaseV1` contract, the total number of storage slots used exceeds the common convention for upgradeable contracts. Specifically, the contract uses 2 storage slots for state variables and reserves an additional 50 storage slots using the `__gap` variable, bringing the total to 52 storage slots. This exceeds the typical convention of reserving a total of 50 storage slots, including used and reserved slots, which may lead to issues in future upgrades if not managed carefully.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (2)

  • GameServerNftBaseV1.sol
  • proxy/GameServerNFT.sol

Part of WEMIX’s security record

WEMIX
Audits75 audits by 1 firmLast audit Feb 2025, by CertiK.
Critical findingsNo open critical findingsAcross the 75 reports, 17 critical findings were reported. Each is marked fixed by the firm that reported it.
Open WEMIX’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us