Looty security record
As of 30 Oct 2026, Looty has 1 audit report on Trustblock, by Paladin, dated 9 May 2024. That report lists no open critical findings. It also holds 2 deployed contracts on 1 chain.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Looty Audit | Security firm: Paladin | Date: | Scope: 2 addresses on Avalanche | No open critical findings | Open · paladinsec.co |
Findings33
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 3 | 3 |
| Medium | 0 | 3 | 11 |
| Low | 2 | 8 | 3 |
HighThe mintedKeys for a user is not incremented in the mintKeys functionLooty Audit · Paladin · 9 May 2024Fixed
The report gives no description here.
Open the reportHighThe same random number should not be used to select both the pool and the reward in pickReward()Looty Audit · Paladin · 9 May 2024Fixed
The report gives no description here.
Open the reportHighThe user can request more keys than what is availableLooty Audit · Paladin · 9 May 2024Fixed
The report gives no description here.
Open the reportMediumChainlink response can failLooty Audit · Paladin · 9 May 2024Fixed
The report gives no description here.
Open the reportMediumChainlink response can failLooty Audit · Paladin · 9 May 2024Fixed
The report gives no description here.
Open the reportMediumChecks-effects-interactions is not respectedLooty Audit · Paladin · 9 May 2024Fixed
The report gives no description here.
Open the reportMediumFee accumulation is not trackedLooty Audit · Paladin · 9 May 2024Fixed
The report gives no description here.
Open the reportMediumfufillRandomWords() may revert if a different configuration is used for when the contract receives the Chainlink requestLooty Audit · Paladin · 9 May 2024Fixed
The report gives no description here.
Open the reportMediumIncorrect transfer method for ERC20s and Native tokenLooty Audit · Paladin · 9 May 2024Fixed
The report gives no description here.
Open the reportMediummintKeys can be DoSedLooty Audit · Paladin · 9 May 2024Fixed
The report gives no description here.
Open the reportShow 7 more
MediummintKeys() incorrectly assumes that the next configuration is valid (not expired)Looty Audit · Paladin · 9 May 2024Fixed
The report gives no description here.
Open the reportMediumThe owner can mint more than totalSupplyLooty Audit · Paladin · 9 May 2024Fixed
The report gives no description here.
Open the reportMediumThe owner is not transferableLooty Audit · Paladin · 9 May 2024Fixed
The report gives no description here.
Open the reportMediumUsers can call mintBox() multiple times with the same key, but only one box will be rewardedLooty Audit · Paladin · 9 May 2024Fixed
The report gives no description here.
Open the reportLowmsg.value can be higher than the required amountLooty Audit · Paladin · 9 May 2024Fixed
The report gives no description here.
Open the reportLowNo way to remove the rewardsLooty Audit · Paladin · 9 May 2024Fixed
The report gives no description here.
Open the reportLowThe KeysMintRequest event should be expandedLooty Audit · Paladin · 9 May 2024Fixed
The report gives no description here.
Open the reportContracts2
| Address | Chain | Source code |
|---|---|---|
| 0x39fb5b7069658045225ea0c86aa68621eecb4887 | Chain: Avalanche | Source code: Verified source |
| 0x7a4d84a2ee5323d7de5691b2fb23c7b700f6084d | Chain: Avalanche | Source code: Verified source |
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="looty"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us