Kresus Lab

QuillAudits6 Feb 2023Files named in the report

Audit · firm’s term: audit report

QuillAudits reviewed Kresus Lab on 6 Feb 2023: 6 findings, 0 critical; none marked fixed.

No open critical findings

Open the report Open Kresus Lab’s security record

Report hosted on quillaudits.com.

Trustblock does not review code.

Findings6

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	1	0	0
Medium	1	0	0
Low	4	0	0

HighAnyone can burn tokensOpen

The functions burn() and burnBatchToken() in KresusNFT.sol are unprotected.KresusNFT.sol lines 148-171 this implies that anyone can call these functions directly on KresusNFT passing in the Proxy address, ids of assets held by proxy and burn the token(s) held by Proxy.

MediumCentralization Risks / Overpowered OwnershipOpen

It is not clear in documentation if the Proxy contract will make use of decentralised control such as MultiSig. Admins can perform privileged activities. The admin has centralised control to mint, burn, migrate and update Kresus NFT contract. If the admin roles are compromised this can have an impact on working of the projects.

LowInput array lengths not all checked for length equalityOpen

KresusNFT.sol line 115 states the following • - Lengths of `_assetIds`, `_tokenURIs` and `_amounts` must be equal. The only check made is require(_amounts.length == _tokenURIs.length, "Kresus NFT: Inconsistent lengths"); however _assetIds are not checked against the other input array sizes .

LowMissing address verification/Zero address checksOpen

Certain functions lack a safety check in the address, the address-type argument should include a zero-address test, otherwise, the contract's functionality may become inaccessible, tokens sent to invalid addresses, tokens may be burned in perpetuity or code may behave unexpectedly.

LowMissing eventsOpen

The missing event makes it difficult to track off-chain and impact off-chain monitoring and incident response functionality. An event should be emitted for significant functionality change, admin related changes to ensure transparency and tracking.

LowUnnecessary use of overrideOpen

Functions in KresusNFT.sol mint(), bulkMint(),burnToken(), burnBatchToken(), batchTransfer(), updateProxyAddress() make use of the override keyword. This is not necessary as contract functions are not overriding any functionality from inherited contracts.