Reality Metaverse security record
As of 3 Nov 2026, Reality Metaverse has 1 audit report on Trustblock, by CertiK, dated 2 Dec 2022. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Reality NFT | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
Findings22
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 2 | 0 |
| Medium | 0 | 0 | 4 |
| Low | 4 | 0 | 12 |
Mediumconstant `EXCHANGERATE_PRECISION` value is invaliReality NFT · CertiK · 2 Dec 2022Fixed
Constant `EXCHANGERATE_PRECISION` is set to be `10^18`, which is value `24` in type `uint256`. Based upon context, it appears this value should be `10**18`.
Open the reportMediumImplementation Contract Is Not Initialized AutomaReality NFT · CertiK · 2 Dec 2022Fixed
When an implementation contract is deployed and the function `initialize()` is called from the proxy contract, it will execute in the context of the proxy contract storage. Hence the state variable `_initialized` and `_initializing` will be 0 and false, respectively. Attackers can directly call the function `initialize(),` bypass the `initializer` modifier, and feed in malicious inputs which can, in turn, affect the proxy.
Open the reportMediumNo Zero Address Validation Check for `sellerAddreReality NFT · CertiK · 2 Dec 2022Fixed
There is no check that `sellerAddress` and `buyerAddress` are not `address(0)`. The respective functions in which each address is used call `_verifyOffer()` and `_verifyBid()` from `TradeSigVerifier`. Each of these functions checks that the returned address from the `recover()` function in OpenZeppelin's ECDSA contract is equal to the specified address. However, OpenZeppelin's ECDSA contract returns `address(0)` when recovery fails.
Open the reportMediumPotential Reentrancy Attack (Not Involving Ether)Reality NFT · CertiK · 2 Dec 2022Fixed
A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. ### External call(s) ```solidity=39 _mint(msg.sender, tokenId, amount, ""); ``` * This function call executes the following external call(s). * In `RealityProperties.__doSafeTransferAcceptanceCheck`, * `IERC1155ReceiverUpgradeable(to).onERC1155Received(operator,from,id,amount,data)`
Open the reportLowClarification on How `nonce` is updatedReality NFT · CertiK · 2 Dec 2022Fixed
In the contract `Trade`, users provide an `offer` input which is verified through functions in the inherited contract `TradeSigVerifier`. A nonce value is included in the `offer` input and is an important aspect in preventing replay attacks. Namely, it is important that the nonce is not repeated.
Open the reportLowDivide Before MultiplyReality NFT · CertiK · 2 Dec 2022Fixed
Performing integer division before multiplication truncates the low bits, losing the precision of calculation. ```solidity return vestedToAllocation[_to] / stepsCount * stepNumber; ```
Open the reportLowFunction `supportsInterface()` Does not return trReality NFT · CertiK · 2 Dec 2022Fixed
The standard EIP-165 outlines that the `supportsInterface()` function should return true for any interfaceID this contract implements. This contract inherits `AccessControl` through the contract `ERC1155HandlerStorage` and as such, should return true when `interfaceId` is equivalent to `type(IAccessControl).interfaceId`.
Open the reportLowImproper Usage of `public` and `external` TypeReality NFT · CertiK · 2 Dec 2022Fixed
`public` functions that are never called by the contract could be declared as `external`.
Open the reportLowMissing `onlyInitializing()` modifier on functionReality NFT · CertiK · 2 Dec 2022Fixed
Functions that should only be called during initialization should be protected with modifier `onlyInitializing()` so that they may only be invoked by functions with the `initializer()` modifier.
Open the reportLowMissing Emit EventsReality NFT · CertiK · 2 Dec 2022Fixed
Functions that affect the status of sensitive variables should emit notifications of updates to storage.
Open the reportShow 6 more
LowMissing Zero Address ValidationReality NFT · CertiK · 2 Dec 2022Fixed
Addresses should be checked before assignment or external calls to ensure they are not zero addresses.
Open the reportLowNo check that `tokenId` is not 0Reality NFT · CertiK · 2 Dec 2022Fixed
The function `fractionalTransferByAdapter()` can be called by any user since it is external. When called, `tokenId` is checked for the `msg.sender` address. For a regular user, the `tokenId` will be 0. Regardless, `_transferFrom()` will still be executed. Such a vulnerability could cause a logical inconsistency. Similarly, functions `_safeTransferFrom()`, `_safeBatchTransferFrom()`, `_mint()`, `_mintBatch()`, `_burn()`, and `_burnBatch()` have no check that `id` is not zero.
Open the reportLowNo state variable used as a `__gap` in upgradeablReality NFT · CertiK · 2 Dec 2022Fixed
The cited contracts are upgradeable, but do not include a `__gap` state variable. Such a state variable is used to hold space in storage so new state variables can be added in future implementations without causing storage incompatibility.
Open the reportLowNo validation check that third party `tokenAddresReality NFT · CertiK · 2 Dec 2022Fixed
Functions `transferFrom()` and `batchTransferFrom()` do not perform checks that the specified input address `tokenAddress` is a supported token. As such, these functions can potentially be used on any token address, including ones with unvetted malicious contract logic.
Open the reportLowUnchecked ERC-20 `transfer()`/`transferFrom()` CaReality NFT · CertiK · 2 Dec 2022Fixed
The return value of the transfer()/transferFrom() call is not checked in the following lines. Since some ERC-20 tokens return no values and others return a `bool` value, they should be handled with care. ```solidity=219 mainCurrency.transferFrom(sender, address(this), amount); ``` --- ```solidity=268 stableCurrency.transferFrom(sender, address(this), stableAmount); ``` --- ```solidity=368 mainCurrency.transfer(to, mainCurrency.balanceOf(address(this)) - _activeBiddingMainTotal); ``` --- ```solidity=374 stableCurrency.transfer(to, stableCurrency.balanceOf(address(this)) - _activeBiddingStableTotal); ``` --- ```solidity=429 mainCurrency.transfer(to, amount); ``` --- ```solidity=431 stableCurrency.transfer(to, amount); ``` --- ```solidity=124 erc20Contract.transfer(to, tokensExcess); ``` --- ```solidity=146 erc20Contract.transfer(sender, toWithdraw); ``` --- ```solidity=87 token.transfer(voucher.receiver, withdrawalAmount); ``` --- ```solidity=105 token.transfer(msg.sender, remainingBalance); ```
Open the reportLowUse of non-upgradeable `AccessControl` in an upgrReality NFT · CertiK · 2 Dec 2022Fixed
The abstract contract `ERC1155HandlerStorage` inherits from OpenZeppelin's `AccessControl` contract, rather than `AccessControlUpgradeable`. Since `ERC1155HandlerStorage` is itself intended to be upgradeable, all inherited contracts and libraries used should also be set up for upgradeability.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="reality-nft"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us