EARN’M DropBox Audit Report
Audit · firm’s term: audit report
Cyfrin reviewed Earnm (EARN’M DropBox Audit Report) on 15 Aug 2024: 5 findings, 1 critical; 4 marked fixed, 1 acknowledged.
Findings5
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 2 |
| Low | 0 | 1 | 1 |
Marked Informational or Gas by the firm. Not counted as findings.
InformationalAvoid floating pragma unless creating librariesFixed
The report gives no description here.
GasBypass first for loop in DropBoxFractalProtocol::_determineTier when randomNumber >= TIER_1_MAX_BOXESFixed
The report gives no description here.
GasCache result of _getOneTimeCodeHash to prevent repeated identical calculation in DropBox::associateOneTimeCodeToAddressFixed
The report gives no description here.
GasCache storage variables when same values read multiple timesFixed
The report gives no description here.
GasChange Box struct to use uint128 saves 1 storage slot per BoxFixed
The report gives no description here.
GasDelete fulfilled vrf request from vrfRequestIdToRequester in VRFHandler::fulfillRandomWordsFixed
The report gives no description here.
GasDon’t initialize to default valuesFixed
The report gives no description here.
GasEnforce ascending order for boxIds to implement more efficient duplicate prevention in DropBox::claimDropBoxesFixed
The report gives no description here.
GasInitialize DropBox::boxIdCounter to 1 avoiding default initialization toFixed
The report gives no description here.
GasOnly read and write once for storage locations boxIdCounter and mintedTierAmount in DropBox::_assignTierAndMintFixed
The report gives no description here.
Show 10 more
GasOnly read and write storage location unclaimedTierAmount once per changed tier in DropBox::_assignTierAndMintFixed
The report gives no description here.
GasOnly read and write storage location unclaimedTierAmount once per changed tier in DropBox::claimDropBoxesFixed
The report gives no description here.
GasPrefer assignment to named return variables and remove explicit return statementsFixed
The report gives no description here.
GasPrefer calldata to memory for external function parametersFixed
The report gives no description here.
InformationalRefactor duplicate fee sending code into one private functionFixed
The report gives no description here.
GasRemove < 0 checks for unsigned variables since they can’t be negativeFixed
The report gives no description here.
GasRemove amountToClaim > 0 check in DropBox::claimDropBoxes as previously reverted if amountToClaim == 0Fixed
The report gives no description here.
GasRemove call to _requireCallerIsContractOwner from Drop- Box::setDefaultRoyalty and setTokenRoyalty since they already have the onlyOwner modifierFixed
The report gives no description here.
GasRemove redundant balance > 0 check from Drop- Box::claimDropBoxesFixed
The report gives no description here.
GasRemove redundant check from VRFHandler::constructorFixed
The report gives no description here.
Show 10 more
GasRemove redundant tierId validity check from Drop- Box::claimDropBoxesFixed
The report gives no description here.
GasRemove second for loop in DropBox::claimDropBoxes and reduce 1 storage read per deleted boxFixed
The report gives no description here.
InformationalResolve discrepancy between expected randomNumber in DropBox::_assignTierAndMint and DropBoxFractalProtocol::_determineTierFixed
The report gives no description here.
GasSimplify checks to fail faster and remove negation operator on final boolean resultFixed
The report gives no description here.
GasUse a simplified and more efficient implementation for DropBoxFractalProtocol::_determineTierFixed
The report gives no description here.
InformationalUse constant TIER_IDS_LENGTH in constructor inputsFixed
The report gives no description here.
GasUse else if for sequential if statements to prevent subsequent checks when a previous check is trueFixed
The report gives no description here.
InformationalUse named imports instead of importing the entire namespaceFixed
The report gives no description here.
InformationalUse named mapping parametersFixed
The report gives no description here.
GasUse uint128 for revealFee and claimFee for more efficient storage packingFixed
The report gives no description here.
Show 2 more
GasUse uint32 for more efficient storage packing when tracking minted and unclaimed tier box amountsFixed
The report gives no description here.
InformationalVRFHandler shouldn’t inherit from ConfirmedOwner since it inherits from VRFConsumerBaseV2Plus which already inherits from ConfirmedOwnerFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Earnm’s security record
Security firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us