Delabs Adventure Pass Staking - Audit

CertiK29 Jun 2023Code version: not recorded (see the report)

CertiK reviewed Delabs Adventure Pass Staking (Delabs Adventure Pass Staking - Audit) on 29 Jun 2023: 9 findings, 0 critical; 4 marked fixed, 3 acknowledged, 2 open.

No open critical findings

Open the report Open Delabs Adventure Pass Staking’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings9

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	2	0	0
Medium	0	0	0
Low	0	3	4

HighCentralization Risks in DelabsAdventurePassStakinOpen

In the contract `DelabsAdventurePassStaking` the role `_owner` has authority over the functions shown in the diagram below. ![](https://accelerator-tasks-prod.acc.corp.certik.com/c8a31e6af0134d3aab3ed51de3dbeee6/diagrams/centralization_DelabsAdventurePassStaking-DelabsAdventurePassStaking-_owner.svg) Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and: - function `forceBatchUnstake()`: to force unstaking a batch of NFTs regardless of the locked period, and still keep the level. - function `setTokenLevel()`: to set the level for an NFT at will. - function `setAdventurePassContract()`: to set the `adventurePass` address. - function `setStakingLevels()`: to set the levels regarding a batch of the locking periods. - function `upsertStakingLevel()`: to set the level regarding one locking period. - function `pauseStaking()`: to pause the staking. - function `unpauseStaking()`: to unpause the staking.

HighCentralized Control of Contract UpgradeOpen

`DelabsAdventurePassStaking` is an upgradeable contract, the owner can upgrade the contract without the community's commitment. If an attacker compromises the account, he can change the implementation of the contract and drain tokens from the contract.