edu3labs - audit

CertiK4 Jul 2023Files named in the report

Audit

CertiK reviewed Edu3Labs (edu3labs - audit) on 4 Jul 2023: 20 findings, 0 critical; 18 marked fixed, 2 open.

No open critical findings

Open the report Open Edu3Labs’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings20

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	1	1
Medium	1	3
Low	0	14

HighCentralization Related RisksOpen

In the contract `Edu3LabsMarketplace` the role `AdminContract` has authority over the functions shown in the diagram below. Any compromise to the `_role` account may allow the hacker to take advantage of this authority. - update platform fee recipient and bps - set auction buffers - set the URI for the contract-level metadata. In the contract `Edu3LabsMultisigController` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority. ![](https://accelerator-tasks-prod.acc.corp.certik.com/6322264da5f44154aed7c26dc2cecf90/diagrams/centralization_Edu3LabsMultisigController-Edu3LabsMultisigController-_owner.svg) In the contract `Edu3LabsMultisigController` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority. ![](https://accelerator-tasks-prod.acc.corp.certik.com/6322264da5f44154aed7c26dc2cecf90/diagrams/centralization_Edu3LabsMultisigController-Edu3LabsMultisigController-_owner.svg)

MediumLack Of Access ControlOpen

The function `claimNFT()` can be called by anyone as it has no access restriction. This enables anyone to call this and mint nfts for themself.