SuperKluster

CertiK19 Jul 2022Files named in the report

Audit

CertiK reviewed Voxel X Network (SuperKluster) on 19 Jul 2022: 14 findings, 1 critical; 13 marked fixed, 1 open.

1 critical finding, fixed

Open the report Open Voxel X Network’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings14

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	1
High	1	3
Medium	0	1
Low	0	8

CriticalNo Initialization for VariableFixed

The `marketplace` is never initialized, so the functions `mintItem()` and `setTokenURI()` can never be invoked.

HighIncomplete Signature CheckFixed

The checked signature is generated using only the first items of input parameters. The caller may alter the remaining parameters to take advantage of the system.

HighNo Check On The Token OwnerFixed

This function doesn't check if the token blongs to the `mgs.sender`.

HighTotal Price Irrelevant With `_quantity`Fixed

The total tokens paid is currently determined by `_price` and irrelevant to the input quantity. Therefore the `_price` input seems to represent the total price of a purchase rather than the item price per NFT.

MediumRoyalty for ERC1155 Does Not Scale With `quantityFixed

The royalty fee of ERC1155 in a deal is determined by the `_price` as unit price for token of a particular id alone and does not scale with the purchasing quantity.

LowFunction Visibility OptimizationFixed

The following functions are declared as `public`, contain array function arguments, and are not invoked in any of the contracts contained within the project's scope. The functions that are never called internally within the contract should have external visibility.

LowLack of Input ValidationFixed

`serviceFee` should not reach 100 percent.

LowMissing Emit EventsFixed

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

LowMissing Error MessagesFixed

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

LowPotential ReentrancyFixed

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. ### External call(s) ```solidity=600 _mint(account, tokenId, supply, ""); ``` * This function call executes the following external call(s). * In `ERC1155._doSafeTransferAcceptanceCheck`, * `IERC1155Receiver(to).onERC1155Received(operator,from,id,amount,data)` * This call sends Ether. ### State variables written after the call(s) ```solidity=605 _setApprovalForAll(account, _msgSender(), true); ``` * This function call executes the following assignment(s). * In `ERC1155._setApprovalForAll`, * `_operatorApprovals[owner][operator] = approved` --- ### External call(s) ```solidity=442 _safeMint(account, tokenId); ``` * This function call executes the following external call(s). * In `ERC721._checkOnERC721Received`, * `IERC721Receiver(to).onERC721Received(_msgSender(),from,tokenId,_data)` * This call sends Ether. ### State variables written after the call(s) ```solidity=446 _setApprovalForAll(account, _msgSender(), true); ``` * This function call executes the following assignment(s). * In `ERC721._setApprovalForAll`, * `_operatorApprovals[owner][operator] = approved` ```solidity=443 _setTokenURI(tokenId, tokenURI_); ``` * This function call executes the following assignment(s). * In `SK721Collection._setTokenURI`, * `_tokenURIs[tokenId] = tokenURI_`

Show 3 more

LowSusceptible to Signature MalleabilityFixed

The signature malleability is possible within the Elliptic Curve cryptographic system. An Elliptic Curve is symmetric on the X-axis, meaning two points can exist with the same `X` value. In the `r`, `s`, and `v` representation this permits us to carefully adjust `s` to produce a second valid signature for the same `r`, thus breaking the assumption that a signature cannot be replayed in what is known as a replay attack.

LowUse of `addItem()` and `buyItem()`Fixed

For add and buy operations, all relevant parameters are provided by the user and validated through the center-controlled signer key. There are no checks on price in the functions and the validity of purchase seems to rely on the signing procedures. Besides, unlike `buyItem()`, there is a check to only allow listed SKCollection.

LowVariables That Could Be Declared as `constant`Fixed

The linked variables could be declared as `constant` since these state variables are never modified.