As of 3 Nov 2026, FreeCity has 1 audit report on Trustblock, by CertiK, dated 26 Sep 2022. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Newest first
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 3 | 1 |
| Medium | 1 | 0 | 0 |
| Low | 10 | 0 | 8 |
In the contract `FreeCityGame_v2.sol`, the function `setBlindBoxBaseUrl()` can be called by anyone as it has no access restriction. This enables anyone to call this and change the URI (Uniform Resource Identifier) of a blind box.
Open the reportBoolean constants can be used directly and do not need to be compared to `true` or `false`.
Open the reportAccessing storage variables in a loop can be costly in terms of gas consumption. ```solidity=261 blindBoxCurrentData = blindBoxCurrentData + 1; ```
Open the reportThere should always be events emitted in sensitive functions that are controlled by centralization roles.
Open the reportThere is no limit on the `protocolFee`, which can therefore be set to an amount that could potentially disrupt contract functionality.
Open the reportThe linked statements do not affect the functionality of the codebase and appear to be either leftovers from test code or older functionality.
Open the reportIn the contract `FreeCityGame_v2.sol`, the variable `blindBoxBaseUri` is misspelled as `blindBoxBaseUrl`.
Open the reportThe following state variables are initialized, but never used in the codebase. * `proxyRegistryAddress` * `_tokenURIs` * `preSales` * `__gap`
Open the reportIt is not recommended to use Solidity's `transfer()` and `send()` functions for transferring Ether, since some contracts may not be able to receive the funds. These functions forward only a fixed amount of gas (2300 specifically) and the receiving contracts may run out of gas before finishing the transfer. Additionally, EVM instructions' gas costs may increase in the future. Thus, some contracts that can receive now may stop working in the future due to the gas limitation. ```solidity=407 payable(protocolFeeRecipient).transfer(calculatedProtocolFee); ``` - `ExchangeCore.executeFundsTransfer` uses `transfer()`.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="freecity"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us