Part of CertiK’s retainer series
CertiK reviewed WEMIX (Wemix Retainer 141 GameServerNFT) on 15 Nov 2024: 5 findings, 0 critical; 2 marked fixed, 3 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 2 | 0 | 1 |
| Medium | 0 | 0 | 0 |
| Low | 1 | 0 | 1 |
In the contract `GameServerNftBaseV1`, the role `GAME_SERVER_ADMIN` has authority over the functions shown in the diagram below. Any compromise to the `GAME_SERVER_ADMIN` account may allow the hacker to take advantage of this authority and update token metadata, as well as mint NFT with metadata URI internally.  In the contract `GameServerNftBaseV1`, the role `GAME_SERVER_SUPER_ADMIN` has authority over the functions shown in the diagram below. Any compromise to the `GAME_SERVER_SUPER_ADMIN` account may allow the hacker to take advantage of this authority and mint NFTs, set token URI, and update token metadata URI. 
In the contract `GameServerNFTBaseV1`, the role `admin` has the authority to update the implementation contract behind the proxy contract contract. Any compromise to the `admin` account may allow a hacker to take advantage of this authority and change the implementation contract which is pointed by proxy and therefore execute potential malicious functionality in the implementation contract.
While not a requirement, generally each upgradeable contract contains 50 storage slots in total, including already used storage slots. In the `GameServerNftBaseV1` contract, the total number of storage slots used exceeds the common convention for upgradeable contracts. Specifically, the contract uses 2 storage slots for state variables and reserves an additional 50 storage slots using the `__gap` variable, bringing the total to 52 storage slots. This exceeds the typical convention of reserving a total of 50 storage slots, including used and reserved slots, which may lead to issues in future upgrades if not managed carefully.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (2)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us