Unchain X Circular Ecosystem

CertiKFiles named in the report

CertiK reviewed UnchainX (Unchain X Circular Ecosystem) on 9 Sep 2024: 14 findings, 2 critical; 13 marked fixed, 1 acknowledged.

2 critical findings, fixed
Open the reportOpen UnchainX’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings14

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical002
High011
Medium001
Low009
HighCentralization Related RisksAcknowledged

### TimeLockController In the contract `TimeLockController`, the role `owner` and `executor` have authority over the functions shown in the diagram below. Any compromise to the `owner` or `executor` account may allow the hacker to take advantage of this authority and enqueue any transaction, execute any transaction already in the queue, or cancel operations. ![](https://accelerator-tasks-prod.acc.corp.certik.com/11ef-653d-636e2cf0-9ad1-e350196bc7c3/diagrams/centralization_TimeLockController-TimeLockController-_ownerorexecutor.svg) --- In addition, the `owner` and `executor` have authority over the function `setExecutor()`. Any compromise to the `owner` or `executor` account may allow the hacker to take advantage of this authority and set the `executor` to a contract or address they have the sole control over. --- In addition, the `owner` has authority over the function `setOwner()`. Any compromise to the `owner` account may allow the hacker to take advantage of this authority and set the `owner` to a contract or address they have the sole control over. --- ### XRecycling In the contract `XRecycling`, the role `owner` has authority over the functions shown in the diagram below. Any compromise to the `owner` account may allow the hacker to take advantage of this authority and preallocate voting power. ![](https://accelerator-tasks-prod.acc.corp.certik.com/11ef-653d-636e2cf0-9ad1-e350196bc7c3/diagrams/centralization_XRecycling-XRecycling-_owner.svg) --- In the contract `XRecycling`, the role `ownerorexecutor` has authority over the functions shown in the diagram below. Any compromise to the `ownerorexecutor` account may allow the hacker to take advantage of this authority and initialize the contract and set its allocation as well as initialize the minting configuration. ![](https://accelerator-tasks-prod.acc.corp.certik.com/11ef-653d-636e2cf0-9ad1-e350196bc7c3/diagrams/centralization_XRecycling-XRecycling-_ownerorexecutor.svg) --- In addition, the contract `XRecycling` depends on being given the correct authority in the `halvingProtocol` and the `halvingProtocol` containing enough funds for the accumulated rewards. --- ### RelayERC20 In the contract `RelayERC20`, the role `minter` has authority over the functions `mint()`. Any compromise to the `minter` address may allow the hacker to take advantage of this authority and mint an arbitrary amount of tokens to any address they control.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (4)

  • contracts/XExplosion.sol
  • contracts/XRecycling.sol
  • contracts/TimeLockController.sol
  • contracts/RelayERC20.sol

Part of UnchainX’s security record

UnchainX
Audits3 audits by 2 firmsLast audit Sep 2024, by CertiK.
Critical findingsNo open critical findingsAcross the 3 reports, 2 critical findings were reported. Each is marked fixed by the firm that reported it.
Open UnchainX’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us