As of 30 Oct 2026, Central African Republic Meme has 1 audit report on Trustblock, by QuillAudits, dated 21 Apr 2025. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Car Coin | Security firm: QuillAudits | Date: | Scope: Files named in the report | No open critical findings | Open · quillaudits.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 0 | 2 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 0 | 0 |
This contract is designed so that land can only be purchased using a message signed by a trusted authority (like an admin or backend service). To enforce this, it defines an AUTHORITY address that's supposed to represent the signer. But instead of setting it to a real address, the contract sets AUTHORITY = address(0), which is just an empty placeholder.address constant private AUTHORITY = address(0); On top of that, the line that checks if the signer of the message actually matches this AUTHORITY is commented out. This means the contract does not validate who signed the message — anyone can pass in a fake message with any signature, and the contract won’t stop it.
Open the reportThis contract handles land sales where users can buy land using an off-chain signed message. The buy function is supposed to verify that the message was signed by a trusted authority before allowing the purchase. However, the check is broken: it usesassert(isSignatureValid || !isSignatureValid);, which is always true. This means anyone can call buy with a fake or random message and still purchase land. The purpose of using off-chain signatures for permission is completely defeated.
Open the reportThe land sale contract relies on off-chain signatures to authorize purchases. Each signed message includes a timestamp, but the contract currently does not enforce any strict freshness checks. The timestamp is only weakly verified with a placeholder condition:assert(block.timestamp > timestamp); This means any previously signed message can be reused indefinitely, as long as the current time is after the message’s timestamp. This opens the door for replay attacks, where a buyer can submit the same message multiple times. This issue becomes critical when combined with the earlier fix we suggested—to allow land to be re-purchased after expiration by checking if block.timestamp > land.expiresAt. While this fix enables proper land reuse, it also means that without replay protection, a buyer can simply reuse an old signature with a previously agreed-upon price and expiration date. This allows them to bypass any updated pricing or terms, undermining the purpose of having dynamic pricing or rental durations.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="central-african-republic-meme"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us