As of 3 Nov 2026, Macondo has 1 audit report on Trustblock, by CertiK, dated 4 Jan 2023. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| W3-Macondo | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 3 | 0 |
| Medium | 0 | 1 | 1 |
| Low | 8 | 0 | 10 |
MacondoBFB --- In the contract `MacondoBFB` the role `MINTER_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `MINTER_ROLE` account may allow the hacker to take advantage of this authority and mint any amount of token to any address.  ---- In the contract `MacondoBFB` the role `PAUSER_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `PAUSER_ROLE` account may allow the hacker to take advantage of this authority and pause or unpause the contract.  ---- In the contract `MacondoBFB` the role `UPGRADER_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `UPGRADER_ROLE` account may allow the hacker to take advantage of this authority and potentially upgrade the logic implementation of the contract.  ---- ---- RandomOracleConsumer ---- In the contract `RandomOracleConsumer` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and request random words and get the random words corresponding to a specific request id.  ---- ---- PokerValidator --- In the contract `PokerValidator` the role `UPGRADER_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `UPGRADER_ROLE` account may allow the hacker to take advantage of this authority and potentially upgrade the implementation of the contract.  ---- ---- TokenCollection --- In the contract `TokenCollection` the role `PAUSER_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `PAUSER_ROLE` account may allow the hacker to take advantage of this authority and pause or unpause the contract.  ---- In the contract `TokenCollection` the role `WITHDRAW` has authority over the functions shown in the diagram below. Any compromise to the `WITHDRAW` account may allow the hacker to take advantage of this authority and drain `BNB` from the contract.  ---- In the contract `TokenCollection` the role `WITHDRAW_ERC20` has authority over the functions shown in the diagram below. Any compromise to the `WITHDRAW_ERC20` account may allow the hacker to take advantage of this authority and drain any ERC20 tokens from the contract.  ---- In the contract `TokenCollection` the role `WITHDRAW_ERC721` has authority over the functions shown in the diagram below. Any compromise to the `WITHDRAW_ERC721` account may allow the hacker to take advantage of this authority and steal ERC721 tokens from the contract.  ---- ---- MacondoTableNFT ---- In the contract `MacondoTableNFT` the role `MINTER_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `MINTER_ROLE` account may allow the hacker to take advantage of this authority and mint tokens to any address they want.  ---- In the contract `MacondoTableNFT` the role `PAUSER_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `PAUSER_ROLE` account may allow the hacker to take advantage of this authority and pause or unpause the contract.  ---- In the contract `MacondoTableNFT` the role `UPGRADER_ROLE` has authority over the functions shown in the diagram
Open the reportThe linked contracts are upgradeable contracts, a privileged role can upgrade the contract without the community's commitment. If an attacker compromises the account, he can change the implementation of the contract and drain tokens from the contract.
Open the reportAll `MacondoMCD` tokens are sent to the contract deployer when deploying the contract. This is a potential centralization risk as the deployer can distribute `MCD` tokens without the consensus of the community.
Open the reportThere is no storage gap preserved in the logic contract. Any logic contract that acts as a base contract that needs to be inherited by other upgradeable child should have a reasonable size of storage gap preserved for the new state variable introduced by the future upgrades.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="macondo"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us