Xwin Finance
CertiK reviewed xWIN Finance on 24 Aug 2022: 25 findings, 0 critical; 14 marked fixed, 11 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Findings25
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 6 | 0 | 2 |
| Medium | 2 | 0 | 3 |
| Low | 3 | 0 | 9 |
High`bid` Should Not Be Called For `ListingType.EngliFixed
If the `bid` function is called for `ListingType.English` keys, the user can bypass the auction process and take the NFT token at a low price.
High`offer` Should Only Be Called For `ListingType.EnFixed
The function `offer` can be called for keys with any `listingType`, but according to the logic, it can only be called with `ListingType.English` keys.
MediumOwner Should Not Cancel The Listing With OffersFixed
The owner can call the function `cancelListingByKey` to cancel any `listing_` with any state, even the `listing_` has the `highestOffer` and the auction process is over. It seems not reasonable from the point of fairness.
MediumThe `listing_` With Offers Could Not Be CanceledFixed
The `cancelListingByKey` function can cancel `listing_`, which may have offer in the `highestOffer[listing_.key]`. It is unreasonable, and it also makes `highestOffer[listing_.key].buyer` can not withdraw their tokens.
MediumUpdate `maxSupply` Is UnsafeFixed
The function `setMaxSupply` can update `maxSupply` to any value, `_maxSupply` maybe less than `totalSupply()`, even less than the minted tokenId.
Low`_listingParams.tokenPayment` Should Be In `suppoFixed
According to the logic of `createListing`, `_listingParams.tokenPayment` should be in `supportPayment.isEligibleToken` when calling `updateBulkListing`.
Low`platformComm` Fee Not CappedFixed
The owner can update `platformComm` to any value greater than the base value(10000).
Low`user.amount` Is Always ZeroFixed
The `_stake` function executes successfully only if `user.amount == 0`, so the aforementioned code will never be executed.
LowChange The Way To Calculate The `managerFee`Fixed
In the function `_payFee`, `managerFee = totalAmount * nft.managerComm() / 10000;` may not include all remain tokens.
LowLack of Input ValidationFixed
The input parameter should be validated according to the business logic, like `managerComm + platformComm + creatorCom` should be 10000 if the owner makes a mistake.
Show 4 more
LowLack of Repeated Listing ValidationFixed
Users can call `_createListing` with the same `_listingParams.tokenId`, which will update an existing `listing`. Updating a `listing` that is in the auction process is unreasonable.
LowMake Sure `highestOff` Is ValidFixed
In the function `_acceptOffer`, there is lack of an explicit validation for `highestOff`, it maybe none.
LowThe `highestOff.buyer` Also Can Call `acceptOfferFixed
The function `acceptOffer` can only be called by the `listing_.tokenId` owner, the `highestOff.buyer` should also have the right to call it.
LowUse `type(uint128).max` Is More ReadableFixed
For an integer type X, you can use type(X).min and type(X).max to access the minimum and maximum value representable by the type.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (13)
- contracts/ERC721.sol
- contracts/ToppySupportPayment.sol
- contracts/ToppyMysteriousNFT.sol
- contracts/IToppyMint.sol
- contracts/ToppyStaking.sol
- contracts/ToppyMint.sol
- contracts/ToppyMarketplace.sol
- contracts/IBEP20.sol
- contracts/ToppyStandardNFT.sol
- contracts/tests/ToppyMarketPlace_test.sol
- contracts/TransferHelper.sol
- contracts/ToppyMasterSetting.sol
- contracts/BEP20.sol
Part of xWIN Finance’s security record
xWIN FinanceSecurity firm
CertiK1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us