Freename

Resonance SecurityFiles named in the report

Resonance Security reviewed Freename on 18 Mar 2023: 24 findings, 3 critical; 18 marked fixed, 6 open.

3 critical findings, fixed
Open the reportOpen Freename’s security record
Report stored on IPFS. Content hash QmP4xLMCti8MCcRGgXrtBWagkcx1WDzgYL1UZJKuUBpzdg

Statuses are the security firm’s own, from this report. Trustblock does not review code.

Findings24

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical003
High003
Medium204
Low408
MediumConcurrent Usage Of Ownable And AccessControlNot fixed

OpenZeppelin implements several standards for the blockchain and EVM development, some of them pertaining to access control over smart contracts. The two major approaches provided by OpenZeppelin are Ownable and AccessControl. While similar in goals, they are built differently for different use cases.The Ownable standard implements a single owner of smart contracts with a single role that can be used to completely control the child contract. The AccessControl standard builds on top of Ownable and additionally implements a more granular approach with the possibility of having multiple roles that can be assigned to multiple addresses.The MinterRole smart contract implements both access control standards unnecessarily, which may lead to an increased difficulty to maintain different access control mechanisms altogether.

MediumMinting SLD Does Not Require Existent TLDNot fixed

The functions related to minting a second-level domain on MintingManager do not validate if the associated top-level domain already exists. This enables a loophole to exist where a second-level domain is not hierarchically attached to a top-level domain. In the context of the system, this fact should not be true.

LowNo Usage of OpenZeppelin's PausableUpgradeable ContractNot fixed

OpenZeppelin implements several standards used all across blockchain development, especially in Solidity and the Ethereum Virtual Machine. These standards primary goal is to unify and normalize development patterns so that the entire blockchain may be more understandable and readily usable.The Freename smart contracts implement source code that mimics or is very similar to components already implemented by OpenZepellin, and could therefore, be switched with the more the standard well-known approach. Such source code includes:Pausable.sol contract, can be substituted with OpenZeppellin's implementation of PausableUpgradeable.It should be noted that the usage of bigger libraries does not constitute an overuse of gas, since only the functions that are used are included on the bytecode of the smart contract.

LowRedundant Code On _beforeMinting()Not fixed

The function _beforeMinting() performs a call to the function isBlocklistDisabled() on line 125. This same call is already performed inside the function isBlocked() that occurs on line 126. Therefore, one of these calls becomes unnecessary and redundant.

LowRedundant Code On Storage ContractsNot fixed

The smart contracts RecordStorage and PropertyStorage, KeyStorage and PropertyKeyStorage have similar implementations between them and can be aggregated to decrease code reuse across the system.

LowUnnecessary Usage of EnumerableMapNot fixed

The state variables _tokenKeys and _tokenPropertiesKeys, on the RecordStorage and PropertyStorage respectively, are being used as a container for already used key hashes. An EnumerableMap is being used for this state variable, however, an EnumerableSet is sufficient for this purpose.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (25)

  • contracts/metatx/ERC2771RegistryContext.sol
  • contracts/storage/KeyStorage.sol
  • contracts/storage/interfaces/IRecordReader.sol
  • contracts/registry/interfaces/IReverseOperations.sol
  • contracts/metatx/MintingManagerForwarder.sol
  • contracts/roles/MinterRole.sol
  • contracts/metatx/interfaces/IForwarder.sol
  • contracts/proxy/interfaces/IDataReader.sol
  • contracts/utils/Pausable.sol
  • contracts/storage/interfaces/IRegistryReader.sol
  • contracts/storage/PropertyStorage.sol
  • contracts/metatx/FNSRegistryForwarder.sol
  • contracts/registry/interfaces/IMintableERC721.sol
  • contracts/minting-manager/interfaces/IMintingManager.sol
  • contracts/storage/RecordStorage.sol
  • contracts/utils/Blocklist.sol
  • contracts/proxy/ProxyReader.sol
  • contracts/registry/interfaces/IFNSRegistry.sol
  • contracts/storage/interfaces/IRecordStorage.sol
  • contracts/minting-manager/MintingManager.sol
  • contracts/metatx/BaseForwarder.sol
  • contracts/registry/FNSRegistry.sol
  • contracts/metatx/ERC2771Context.sol
  • contracts/storage/PropertyKeyStorage.sol
  • contracts/proxy/interfaces/IERC1967.sol

Part of Freename’s security record

Freename
Audits1 audit by 1 firmLast audit Mar 2023, by Resonance Security.
Critical findingsNo open critical findingsIn that report, 3 critical findings were reported. Each is marked fixed by the firm that reported it.
Open Freename’s security record

Security firm

Resonance Security

18 projects reviewed · 25 reports · latest Aug 2025

See Resonance Security’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us