Xyro
Audit · firm’s term: smart contract review
Zokyo reviewed XYRO on 30 Aug 2024: 38 findings, 6 critical; 32 marked fixed, 6 acknowledged.
Trustblock does not review code.
Findings38
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 1 | 5 |
| High | 0 | 0 | 4 |
| Medium | 0 | 2 | 9 |
| Low | 0 | 3 | 14 |
Critical`stopLoss` and` takeProfit` can be set in the same direction, leading to `stopLoss` voters be always the winnersFixed
The report gives no description here.
CriticalAnyone can drain the treasuryFixed
The report gives no description here.
CriticalFunds can be stolen after wrong approveFixed
The report gives no description here.
CriticalLock of fund due to the precision lossFixed
The report gives no description here.
CriticalUsers can lose funds due to `safeTransferFrom` after approvalFixed
The report gives no description here.
HighFinal prices within a threshold of 10 minutes are accepted, leading to a different result than the real one and causing winners not earning fundsFixed
The report gives no description here.
HighFinalizing a game after 10 minutes will lock user’s earned fundsFixed
The report gives no description here.
HighOne side players have more probability of winning than the otherFixed
The report gives no description here.
HighThe opponent has a higher probability of winning than the initiator of the gameFixed
The report gives no description here.
Medium‘DISTRIBUTOR` AND `DEFAULT_ADMIN` ROLES CAN DRAIN THE WHOLE TREASURYFixed
The report gives no description here.
Show 10 more
Medium`collectedFee` can be easily inflatedFixed
The report gives no description here.
Medium`endTime` can be set higher than `stopPredictAt` leading to a wrong behavior of the protocolFixed
The report gives no description here.
Medium`startTime` is not checked, allowing games with past prices to be startedFixed
The report gives no description here.
MediumAttacker Can Steal Initiator FeesFixed
The report gives no description here.
MediumCalculated commission cut does not align with the expected percentagesFixed
The report gives no description here.
MediumIf Approved Token Is A Fee-On-Transfer Token Then The Refund/Distribution Would Be BrokenFixed
The report gives no description here.
MediumPlaying is restricted for an unlimited amount of usersFixed
The report gives no description here.
MediumReward Distribution Or Refunds Can Be Griefed If One Of The Address Gets BlacklistedFixed
The report gives no description here.
Low`depositAmounts` marks an incorrect amount of funds after closing a game which may lead to wrong implications in future updates or external parts r...Fixed
The report gives no description here.
Low`endTime` can be set to a lower value than `startTime`Fixed
The report gives no description here.
Show 10 more
LowAdd A Sanity Check For End TimeFixed
The report gives no description here.
LowCollectedFees Is Not Paid Out AnywhereFixed
The report gives no description here.
LowGame initiator is allowed to set his own address as opponent, leading to creating a non-payable gameFixed
The report gives no description here.
LowLack of eventsFixed
The report gives no description here.
LowMissing zero address checkFixed
The report gives no description here.
LowOverflow on updating the deposited amountFixed
The report gives no description here.
LowReentrance To Drain Funds If Approved Token Is A Callback Token (ERC777)Fixed
The report gives no description here.
LowThe `calculateUpDownRate` function does not distribute feesFixed
The report gives no description here.
LowThe `refuseGame` functionality is uselessFixed
The report gives no description here.
LowThe `withdrawFees` and `withdrawRakeback` functions are not following the decimal notation from the rest of functions, which may lead to an incorre...Fixed
The report gives no description here.
Show 2 more
LowUser can play knowing the starting priceFixed
The report gives no description here.
LowUsers Can Make A Safe Bet In UpDown Game And Increase Their Chances Of WinningFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (10)
- https://github.com/xyro-io/smart-contracts/contracts/Treasury.sol at commit b7f77decbaae02efbba0281fd8fb30d869b5d3f6
- https://github.com/xyro-io/smart-contracts/contracts/Setup.sol at commit b7f77decbaae02efbba0281fd8fb30d869b5d3f6
- https://github.com/xyro-io/smart-contracts/contracts/Bullseye.sol at commit b7f77decbaae02efbba0281fd8fb30d869b5d3f6
- https://github.com/xyro-io/smart-contracts/contracts/Bullseye.sol at commit b9b699ad9ddf7408300eacb8c431c56cc70f2805
- https://github.com/xyro-io/smart-contracts/contracts/Setup.sol at commit b9b699ad9ddf7408300eacb8c431c56cc70f2805
- https://github.com/xyro-io/smart-contracts/contracts/Treasury.sol at commit b9b699ad9ddf7408300eacb8c431c56cc70f2805
- https://github.com/xyro-io/smart-contracts/contracts/UpDown.sol at commit b7f77decbaae02efbba0281fd8fb30d869b5d3f6
- https://github.com/xyro-io/smart-contracts/contracts/OneVsOneExactPrice.sol at commit b7f77decbaae02efbba0281fd8fb30d869b5d3f6
- https://github.com/xyro-io/smart-contracts/contracts/OneVsOneExactPrice.sol at commit b9b699ad9ddf7408300eacb8c431c56cc70f2805
- https://github.com/xyro-io/smart-contracts/contracts/UpDown.sol at commit b9b699ad9ddf7408300eacb8c431c56cc70f2805
Part of XYRO’s security record
XYROSecurity firm
Zokyo89 projects reviewed · 131 reports · latest Feb 2025
See Zokyo’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us