CertiK reviewed UnchainX (Unchain X Circular Ecosystem) on 9 Sep 2024: 14 findings, 2 critical; 13 marked fixed, 1 acknowledged.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 1 | 1 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 0 | 9 |
### TimeLockController In the contract `TimeLockController`, the role `owner` and `executor` have authority over the functions shown in the diagram below. Any compromise to the `owner` or `executor` account may allow the hacker to take advantage of this authority and enqueue any transaction, execute any transaction already in the queue, or cancel operations.  --- In addition, the `owner` and `executor` have authority over the function `setExecutor()`. Any compromise to the `owner` or `executor` account may allow the hacker to take advantage of this authority and set the `executor` to a contract or address they have the sole control over. --- In addition, the `owner` has authority over the function `setOwner()`. Any compromise to the `owner` account may allow the hacker to take advantage of this authority and set the `owner` to a contract or address they have the sole control over. --- ### XRecycling In the contract `XRecycling`, the role `owner` has authority over the functions shown in the diagram below. Any compromise to the `owner` account may allow the hacker to take advantage of this authority and preallocate voting power.  --- In the contract `XRecycling`, the role `ownerorexecutor` has authority over the functions shown in the diagram below. Any compromise to the `ownerorexecutor` account may allow the hacker to take advantage of this authority and initialize the contract and set its allocation as well as initialize the minting configuration.  --- In addition, the contract `XRecycling` depends on being given the correct authority in the `halvingProtocol` and the `halvingProtocol` containing enough funds for the accumulated rewards. --- ### RelayERC20 In the contract `RelayERC20`, the role `minter` has authority over the functions `mint()`. Any compromise to the `minter` address may allow the hacker to take advantage of this authority and mint an arbitrary amount of tokens to any address they control.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (4)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us