As of 3 Nov 2026, Paradox Metaverse has 1 audit report on Trustblock, by CertiK, dated 11 Nov 2022. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Paradox Meta | Security firm: CertiK | Date: | Scope: Files named in the report | 2 critical findings, fixed | Open · skynet.certik.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 1 | 0 |
| Medium | 1 | 0 | 1 |
| Low | 8 | 0 | 5 |
The staking rewards `payout` has been included in `stakeReturn`. While `usr.rewardDebt` is not updated to avoid multi claims.
Open the reportThe payout is calculated with `usr.stakeSharesTotal`. It should be based on the share of the stake. Otherwise, it is only relative to days. For example, user A stakes 1$ one year ago and stakes 100,000$ this year. He/She can claim the 1-year payout based on the total 100,001$.
Open the reportThe calculation of `rewardDebt` should be `userPosition.totalAmount * vPool.accParaPerShare` rather than `newStakedParas * vPool.accParaPerShare`. In the farming contract, each time the total amount changes, the staged reward must be stored and the reward debt should be updated to the latest `totalAmount * paraPershare`. So that the changing variable `amount` can be controlled to make the `accPerParaShare` the only changing variable to calculate rewards.
Open the reportThe cost of adding the share is to give up the old rewards (because the calculation of the `rewardDebt`). If the part of tokens give up the reward, and the rewards are released according to the total shares. So the actually claimed rewards may be different from the scheduled.
Open the reportThe mapping of `stakeIndex` to `stakeIdParam` should be checked in the function `endStake()` to ensure the target stake is the one that the caller want to end.
Open the reportThe function `_safeMint()` performs an external call, providing chance for potential reentrancy attacks. Better to move `_safeMint()` to the last of the functions.
Open the reportThe mentioned code can be directly changed to: ```Solidity=239 virtualPool.lastRewardTime = block.timestamp; ```
Open the reportThe linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="paradox-metaverse"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us