Crypto Chronic

CertiKFiles named in the report

CertiK reviewed CryptoChronic (Crypto Chronic) on 29 Jun 2023: 8 findings, 0 critical; 2 marked fixed, 6 acknowledged.

No open critical findings
Open the reportOpen CryptoChronic’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings8

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High010
Medium000
Low052
HighCentralization Related RisksAcknowledged

In the contract `Feeder` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority to pause/resume functionalities of this contract, set the `Chronic` contract address, set the fertility price, withdraw ETH from the contract, renounce ownership, and transfer ownership to a new owner. ![](https://accelerator-tasks-prod.acc.corp.certik.com/007e74b750df4c0bafb9efa001648dea/diagrams/centralization_Feeder-Feeder-_owner.svg) In the contract `Chronic` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and disable the craft, freeze URI, pause/resume the contract, set the `Breeder` contract address, set the `Feeder` contract address, set the freezer address, set the initial token value, set the base token URI, set the base image URI, set the base contract URI, craft NFT to anyone, renounce ownership, and transfer ownership to a new owner. ![](https://accelerator-tasks-prod.acc.corp.certik.com/007e74b750df4c0bafb9efa001648dea/diagrams/centralization_Chronic-Chronic-_owner.svg) In the contract `Chronic` the role `freezerAddress` has authority over the functions shown in the diagram below. Any compromise to the `freezerAddress` account may allow the hacker to take advantage of this authority to `unfreezeToken` and `setOtherBCtokenId`. ![](https://accelerator-tasks-prod.acc.corp.certik.com/007e74b750df4c0bafb9efa001648dea/diagrams/centralization_Chronic-Chronic-freezerAddress.svg) In the contract `Breeder` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and pause/resume the contract, set the `Chronic` contract address, set the breed price, set mint price, set fertility, set series, set layers, set layer value, set layer part, set weights, create CryptoChronicNFT, breed the gene, withdraw ETH from the contract, renounce ownership, and transfer ownership to a new owner. ![](https://accelerator-tasks-prod.acc.corp.certik.com/007e74b750df4c0bafb9efa001648dea/diagrams/centralization_Breeder-Breeder-_owner.svg)

LowMissing Emit EventsAcknowledged

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

LowMissing Zero Address ValidationAcknowledged

Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=1934 breederAddress = _breederAddress; ``` - `_breederAddress` is not zero-checked before being used. --- ```solidity=1935 feederAddress = _feederAddress; ``` - `_feederAddress` is not zero-checked before being used. --- ```solidity=1936 freezerAddress = _freezerAddress; ``` - `_freezerAddress` is not zero-checked before being used.

LowReusable `signature`Acknowledged

While the `mintWhitelistedChronic()` function requires a `signature` generated by the whitelist, it does not verify if the `signature` has been previously used. Consequently, the `signature` can be reused, enabling anyone to mint `Chronic` with `wlPrice` by utilizing the same `signature`.

LowUnused Return ValueAcknowledged

The return value of an external call is not stored in a local or state variable. ```solidity=621 cc.mint(to, gene, 0, 0, fertility); ``` --- ```solidity=636 cc.mint(_msgSender(), gene, 0, 0, fertility); ```

LowWeak PRNGAcknowledged

Weak PRNG due to a modulo on `block.timestamp` and `block.difficulty`. These can be influenced by miners to some extent, so they should be avoided. ```solidity=691 return uint256(keccak256(abi.encodePacked(block.difficulty, block.timestamp, (_initialNumber++)))) % number; ```

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (3)

  • contracts/Chronic.sol
  • contracts/Breeder.sol
  • contracts/Feeder.sol

Part of CryptoChronic’s security record

CryptoChronic
Audits1 audit by 1 firmLast audit Jun 2023, by CertiK.
Critical findingsNo open critical findingsIn 1 report.
Open CryptoChronic’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us