Sandbox V1

CertiK7 Jan 2022Files named in the report

Audit

CertiK reviewed The Sandbox (Sandbox V1) on 7 Jan 2022: 20 findings, 0 critical; 9 marked fixed, 11 open.

No open critical findings

Open the report Open The Sandbox’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings20

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	0	1
Medium	0	1
Low	11	7

LowAssignment OptimizationOpen

Saving information of address owner and bool operatorEnabled in a uint256 is of high efficiency. However, this data structure requires developers to stay aware of the changes when they are trying to make conversion between uint256 and address.

LowMissing Input ValidationOpen

The given input `size` is missing the check for the non-zero address.

LowProper usage of `pure`Open

The pure functions do not read or modify the state variables, which returns the values only using the parameters passed to the function or local variables present in it.

LowProper usage of `view`Open

The view functions are read-only function, which ensures that state variables cannot be modified after calling them.

LowPull-Over-Push Pattern for changeAdmin()Open

The change of `admin` by function `changeAdmin()` overrides the previously set `admin` with the new one without guaranteeing the new `admin` can actuate transactions on-chain.

LowPull-Over-Push Pattern for constructorOpen

In the constructor, the variable `_admin` is assigned by an explicit `admin` address, and the input is not validated.

LowPull-Over-Push Pattern for constructorOpen

In the constructor, the variable `_admin` is assigned by an explicit `admin` address, and the input is not validated.

LowSafeMath Not UsedOpen

SafeMath from OpenZeppelin is not used in the following functions which makes them possible for overflow/underflow and will lead to an inaccurate calculation result.

LowSafeMath Not UsedOpen

SafeMath from OpenZeppelin is not used in the following functions which makes them possible for overflow/underflow and will lead to an inaccurate calculation result. - `_burn()` - `_transferFrom()` - `_batchTransferFrom()`

LowSafeMath Not UsedOpen

SafeMath from OpenZeppelin is not used in the following functions which makes them possible for overflow/underflow and will lead to an inaccurate calculation result. - `x()` - `y()`

Show 1 more

LowUsage of `uint` Alias Instead of `uint256`Open

According to the coding practice, the `uint` is an alias for `uint256` and both represent the same underlying integer allocation. It is advisable that for clean coding practices the complete form `uint256` should be used instead of the alias `uint`.