Business Carbify security record
As of 4 Nov 2026, Business Carbify has 4 audit reports by 2 security firms on Trustblock; the latest is by SolidProof, dated 2 Oct 2024. Those reports list no open critical findings. It also holds 5 deployed contracts on 1 chain.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Audits4
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Carbify Staking | Security firm: SolidProof | Date: | Scope: 4 addresses on Polygon (POS) | No open critical findings | Open · IPFS |
| Carbify - Aco2Rewards | Security firm: QuillAudits | Date: | Scope: Files named in the report | No open critical findings | Open · quillaudits.com |
| Carbify - NFT | Security firm: QuillAudits | Date: | Scope: Files named in the report | No open critical findings | Open · quillaudits.com |
| Carbify | Security firm: QuillAudits | Date: | Scope: 1 address on Polygon (POS) | 1 critical finding, fixed | Open · IPFS |
Findings21
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 1 |
| Medium | 3 | 0 | 3 |
| Low | 3 | 1 | 9 |
CriticalUntitled findingCarbify · QuillAudits · 11 Apr 2023Fixed
No description was provided.
Open the reportHigh• Overlaping of tokenId indexes of NFTs would lead minting of NFT at same tokenId.Carbify - NFT · QuillAudits · 11 May 2023Fixed
At NftreeFactory.sol#L151-152 incorrect firstIndex and lastIndex get calculated during ecoEmpire and backup initialization. ecoEmpire’s batch firstIndex and lastIndex is shortfall by 1 while backup’s batch firstIndex and lastIndex is shortfall by 2.Because of this overlapping of indexes ecoEmpire would mint its NFT at the lastIndex of Staking NFT similarly backup NFT get minted at ecoEmpire’s lastIndex.
Open the reportMedium• Incorrect fees precedence.Carbify - NFT · QuillAudits · 11 May 2023Fixed
At Nftree.sol#L220-221, In updateFees function fee1, fee2 & fee3 are set but all are validated against MAX_FEE i.e. fee1, fee2, fee3 <= MAX_FEE , It is a valid check but the updateFees should have additional check where it validates that MAX_FEE >= fee1 > fee2 > fee3 otherwise it will defeat the purpose of having different fees value for different period of deposit. E.g. paying more fee for keeping the deposit of CBY for 2 years compare to the deposit of 6 months.
Open the reportMedium• Multiple deposits of CBY for a tokenId would lead to pay more fees by the users.Carbify - NFT · QuillAudits · 11 May 2023Fixed
At Nftree.sol#L601, Deposit time is set as the block.timestamp, However, if the user deposits more tokens for a same tokenId after a year then user deposit timestamp get set as the latest deposit timestamp and user have to pay fee1 bracket even for the withdrawal of the early deposit amount. This would discourage the recurring deposits corresponds to a single tokenId.
Open the reportMediumUntitled findingCarbify · QuillAudits · 11 Apr 2023Fixed
No description was provided.
Open the reportLowAdditional Check for Zero Address Cost High Gas ConsumptionCarbify - Aco2Rewards · QuillAudits · 17 Aug 2023Fixed
In the burn and mint functions, there were two checks to prevent that the to address and account addresses are not a null address and the second check is to prevent minting and burning of zero amount. While the second check is appropriate, the present of the first check will hike the cost of gas for calling these functions. The _mint and _burn functions from the ERC20 openzeppelin library already has this check to prevent minting or burning
Open the reportLowRemoved Unused Interfaces in Both ContractsCarbify - Aco2Rewards · QuillAudits · 17 Aug 2023Fixed
There are a few imports made in both contracts to be used but were not called within them.In Aoc2 - ICRC.sol In NFTree - IERC721EnumerableUpgradable and ITree
Open the reportLowUnlocked pragma ( pragma solidity ^0.8.17 )Carbify - Aco2Rewards · QuillAudits · 17 Aug 2023Fixed
Contracts should be deployed with the same compiler version and flags that they have been tested with thoroughly. Locking the pragma helps to ensure that contracts do not accidentally get deployed using, for example, an outdated compiler version that might introduce bugs that affect the contract system negatively.
Open the reportLow• Micelleanous recommendation for the code cleanupCarbify - NFT · QuillAudits · 11 May 2023Fixed
At Nftree.sol#L236 & Nftree.sol#L249, Recommended to not use the require statement in the view functions instead return false & (false, 0) respectively. It would be better for the UX.
Open the reportLowUntitled findingCarbify · QuillAudits · 11 Apr 2023Fixed
No description was provided.
Open the reportShow 4 more
LowUntitled findingCarbify · QuillAudits · 11 Apr 2023Fixed
No description was provided.
Open the reportLowUntitled findingCarbify · QuillAudits · 11 Apr 2023Fixed
No description was provided.
Open the reportLowUntitled findingCarbify · QuillAudits · 11 Apr 2023Fixed
No description was provided.
Open the reportLowUntitled findingCarbify · QuillAudits · 11 Apr 2023Fixed
No description was provided.
Open the reportContracts5
| Address | Chain | Source code |
|---|---|---|
| 0x81e391e3e9d9922ae8f0761386dabac2d7b6342f | Chain: Polygon (POS) | Source code: Verified source |
| 0x3b8c4c1f01fdc95c7106762d815525ac638b4900 | Chain: Polygon (POS) | Source code: Verified source |
| 0x0f3e13fd7765c1147d76084002130915f3277575 | Chain: Polygon (POS) | Source code: Verified source |
| 0x0c666a23304e71294eb2a03b4c27367756e74e01 | Chain: Polygon (POS) | Source code: Verified source |
| 0x51f7c5dbafc47fc15c77768a35f72c84280cdcad | Chain: Polygon (POS) | Source code: Verified source |
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="carbify"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us