Carrot Coin

CertiK29 Aug 2022Files named in the report

Audit

CertiK reviewed Carrot Coin on 29 Aug 2022: 8 findings, 0 critical; 3 marked fixed, 5 open.

No open critical findings

Open the report Open Carrot Coin’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings8

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	3	0
Medium	0	0
Low	2	3

HighCentralization Risks in CarrotNFT.solOpen

In the contract `CarrotNFT` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority. ![](https://accelerator-tasks-prod.acc.corp.certik.com/914c6ca0b3034270a9527e38ad67bec2/diagrams/centralization_CarrotNFT__owner.svg) In the contract `CarrotNFT` the role `gnosisSafe` has authority over the functions shown in the diagram below. Any compromise to the `gnosisSafe` account may allow the hacker to take advantage of this authority and cause severe damage to the system. The address of `gnosisSafe` is `0xd25A2363443bB9F3A830Ad525C13E75D52028d49` and we would appreciate the team to provide more information about this address. ![](https://accelerator-tasks-prod.acc.corp.certik.com/914c6ca0b3034270a9527e38ad67bec2/diagrams/centralization_CarrotNFT_gnosisSafe.svg)

HighCentralization Risks in CarrotNFT1155.solOpen

In the contract `CarrotNFT1155` the role `gnosisSafe` has authority over the functions shown in the diagram below. Any compromise to the `gnosisSafe` account may allow the hacker to take advantage of this authority. ![](https://accelerator-tasks-prod.acc.corp.certik.com/9bf2efe4d0664c09a7fb167945ff421a/diagrams/centralization_CarrotNFT1155-CarrotNFT1155-gnosisSafe.svg)

HighInitial Token DistributionOpen

Half of the Carrot tokens total supply is sent to the `companyTreasury` and the other half is sent to `carrotApp` when deploying the contract. This could be a centralization risk as we don't know who owns `companyTreasury` and `carrotApp` addresses and their owners can distribute Carrot tokens without obtaining the consensus of the community.

LowMissing Emit EventsOpen

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

LowVariables That Could Be Declared as `constant`Open

The linked variables could be declared as `constant` since these state variables are never modified.