CertiK reviewed CryptoChronic (Crypto Chronic) on 29 Jun 2023: 8 findings, 0 critical; 2 marked fixed, 6 acknowledged.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 5 | 2 |
In the contract `Feeder` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority to pause/resume functionalities of this contract, set the `Chronic` contract address, set the fertility price, withdraw ETH from the contract, renounce ownership, and transfer ownership to a new owner.  In the contract `Chronic` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and disable the craft, freeze URI, pause/resume the contract, set the `Breeder` contract address, set the `Feeder` contract address, set the freezer address, set the initial token value, set the base token URI, set the base image URI, set the base contract URI, craft NFT to anyone, renounce ownership, and transfer ownership to a new owner.  In the contract `Chronic` the role `freezerAddress` has authority over the functions shown in the diagram below. Any compromise to the `freezerAddress` account may allow the hacker to take advantage of this authority to `unfreezeToken` and `setOtherBCtokenId`.  In the contract `Breeder` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and pause/resume the contract, set the `Chronic` contract address, set the breed price, set mint price, set fertility, set series, set layers, set layer value, set layer part, set weights, create CryptoChronicNFT, breed the gene, withdraw ETH from the contract, renounce ownership, and transfer ownership to a new owner. 
There should always be events emitted in the sensitive functions that are controlled by centralization roles.
Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=1934 breederAddress = _breederAddress; ``` - `_breederAddress` is not zero-checked before being used. --- ```solidity=1935 feederAddress = _feederAddress; ``` - `_feederAddress` is not zero-checked before being used. --- ```solidity=1936 freezerAddress = _freezerAddress; ``` - `_freezerAddress` is not zero-checked before being used.
While the `mintWhitelistedChronic()` function requires a `signature` generated by the whitelist, it does not verify if the `signature` has been previously used. Consequently, the `signature` can be reused, enabling anyone to mint `Chronic` with `wlPrice` by utilizing the same `signature`.
The return value of an external call is not stored in a local or state variable. ```solidity=621 cc.mint(to, gene, 0, 0, fertility); ``` --- ```solidity=636 cc.mint(_msgSender(), gene, 0, 0, fertility); ```
Weak PRNG due to a modulo on `block.timestamp` and `block.difficulty`. These can be influenced by miners to some extent, so they should be avoided. ```solidity=691 return uint256(keccak256(abi.encodePacked(block.difficulty, block.timestamp, (_initialNumber++)))) % number; ```
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (3)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us