As of 3 Nov 2026, Infinity Games has 1 audit report on Trustblock, by CertiK, dated 8 Feb 2023. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Infinity Angel | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 2 | 0 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 7 | 4 |
To bridge the gap in trust between the administrators need to express a sincere attitude regarding the considerations of the administrator teamʼs anonymity. In the contract `BoxPurchase`, the role `owner` has authority over the following functions: - set `foundationAddress` through `setFoundationAddress()` - set `verifier` through `setVerifier()` - pause the contract through `pause()` - unpause the contract through `unpause()` In the contract `BoxPurchase`, the role `verifier` has authority over the following functions: - purchase box through `purchaseBox()` In the contract `GameNFT`, the role `owner` has authority over the following functions: - pause the contract through `pause()` - unpause the contract through `unpause()` - mint nft to anyone through `safeMint()` - set tokenʼs `tokenUri` through `setTokenURI()` - set `marketAddress` through `setMarketAddress()` - burn token through `burn()` In the contract `MarketLogic`, the role `verifier` has authority over the following functions: - purchase ERC721 through `purchaseERC721()` In the contract `MarketLogic`, the role `owner` has authority over the following functions: - set `verifier` through `setVerifier()` - transfer anyone's NFT to anyone `transferHelperERC721()` - set `foundationAddress` through `setFoundationAddress()` - pause the contract through `pause()` - unpause the contract through `unpause()` In the contract `TransparentUpgradeableProxy`, the role `admin` has authority over the following functions: - view admin through `admin()` - view `implementation_` through `implementation()` - change admin through `changeAdmin()` - upgrade contract through `upgradeTo()` - upgrade contract and call function through `upgradeToAndCall()` In the contract `TokenPurchase`, the role `owner` has authority over the following functions: - set token list through `setListedToken()` - withdraw contract's ETH/BNB through `withdraw()` - pause the contract through `pause()` - unpause the contract through `unpause()` Any compromise to the key role account may allow a hacker to take advantage of this authority.
Open the reportThe Openzeppelin-upgrades are libraries that can deploy upgradeable contracts, upgrade deployed contracts, and manage proxy admin rights. The `BoxPurchase`, `GameNFT`, `MarketLogic`, and `TokenPurchase` are implemented based on the upgradeable contract, which can be updated by artificial control. Any updates should be taken seriously, uncertain updates may lead to losses.
Open the reportThe function `purchaseBox` accepts BNB/ETH or ERC20 tokens to purchase NFT, in this function only the user's tokens are transferred to `foundationAddress`, but NFT is not transferred to the user, there is only one event `BoxPaid`. And the parameter `orderData` is used without any reasonableness and security checks.
Open the reportThe parameter `orderData` of the function `purchaseERC721` is used without any reasonableness and security checks.
Open the reportIn the function `transferHelperERC721`, the owner can transfer anyone's NFT to anyone.
Open the report`public` functions that are never called by the contract could be declared `external`. When the inputs are arrays, `external` functions are more efficient than `public` functions.
Open the reportThe given input is missing the check for the non-zero address.
Open the reportFunctions that affect the status of sensitive variables should be able to emit events as notifications to customers. - `setFoundationAddress()` - `setVerifier()` - `changeProxyAdmin()` - `upgrade()` - `upgradeAndCall()` - `setVerifier()` - `transferHelperERC721()` - `setFoundationAddress()` - `withdraw()` - `setListedToken()` - `setMarketAddress()` - `setTokenURI()`
Open the reportMalicious hackers may observe the pending transaction which will execute the `initialize` function and launch a similar transaction with the hacker's address.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="infinity-games"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us