MAZE - audit

CertiK4 Jul 2022Not recorded. See the report

CertiK reviewed MAZE (MAZE - audit) on 4 Jul 2022: 8 findings, 0 critical; 3 marked fixed, 5 acknowledged.

No open critical findings

Open the report Open MAZE’s security record

Report hosted on skynet.certik.com.

Statuses are the security firm’s own, from this report. Trustblock does not review code.

Findings8

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	0	0
High	1	1
Medium	1	0
Low	3	2

HighMissing Check on reward and staking tokensFixed

Compared to the other MasterChef contracts, the reward token is minted from the contract. The current project requires the reward token to be sent to the MasterChef contract. In the `RoyalMasterChef.sol`, there is no check on the overlap between the reward tokens and the existing staked (lpTokens). A reward token is the same as the stake token for one pool. So users' staked tokens would be at risk of being drained from the contract as reward payouts. Possible Exploit Scenario: If the reward token does not have enough amount to pay the reward for the pool, the reward token that users deposit will be sent out as the reward

LowConfusing `if` StructureFixed

The block under the `if` is empty.

LowMissing Zero Address ValidationFixed

Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=1783 swapPayAddr = _newAddr; ``` - `_newAddr` is not zero-checked before being used.