Looty Audit
Paladin reviewed Looty (Looty Audit) on 9 May 2024: 33 findings, 0 critical; 17 marked fixed, 14 acknowledged, 2 open.
Report hosted on paladinsec.co.
Trustblock does not review code.
Findings33
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 3 | 3 |
| Medium | 0 | 3 | 11 |
| Low | 2 | 8 | 3 |
HighThe mintedKeys for a user is not incremented in the mintKeys functionFixed
The report gives no description here.
HighThe same random number should not be used to select both the pool and the reward in pickReward()Fixed
The report gives no description here.
HighThe user can request more keys than what is availableFixed
The report gives no description here.
MediumChainlink response can failFixed
The report gives no description here.
MediumChainlink response can failFixed
The report gives no description here.
MediumChecks-effects-interactions is not respectedFixed
The report gives no description here.
MediumFee accumulation is not trackedFixed
The report gives no description here.
MediumfufillRandomWords() may revert if a different configuration is used for when the contract receives the Chainlink requestFixed
The report gives no description here.
MediumIncorrect transfer method for ERC20s and Native tokenFixed
The report gives no description here.
MediummintKeys can be DoSedFixed
The report gives no description here.
Show 7 more
MediummintKeys() incorrectly assumes that the next configuration is valid (not expired)Fixed
The report gives no description here.
MediumThe owner can mint more than totalSupplyFixed
The report gives no description here.
MediumThe owner is not transferableFixed
The report gives no description here.
MediumUsers can call mintBox() multiple times with the same key, but only one box will be rewardedFixed
The report gives no description here.
Lowmsg.value can be higher than the required amountFixed
The report gives no description here.
LowNo way to remove the rewardsFixed
The report gives no description here.
LowThe KeysMintRequest event should be expandedFixed
The report gives no description here.
Contracts in scope2
| Address | Chain | Source code |
|---|---|---|
| 0x39fb5b7069658045225ea0c86aa68621eecb4887 | Chain: Avalanche | Source code: Verified source |
| 0x7a4d84a2ee5323d7de5691b2fb23c7b700f6084d | Chain: Avalanche | Source code: Verified source |
Part of Looty’s security record
LootySecurity firm
Paladin176 projects reviewed · 241 reports · latest Apr 2025
See Paladin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us