As of 3 Nov 2026, Red Light District Metaverse has 1 audit report on Trustblock, by CertiK, dated 24 Jan 2023. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Red Light District Metaverse Token - Audit | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 3 | 0 | 1 |
| Medium | 0 | 0 | 1 |
| Low | 1 | 0 | 17 |
The function `swapAndLiquify()` is used to distribute the fees to various wallets as well as to add liquidity. However, this function is `private` and never used in the contract. Thus it will never be called and cause the fees to not be distributed as designed.
Open the reportThe `_swapAndLiquify()` function converts half of the contracts `RLDM` token balance to `BNB`. The other half of `RLDM` tokens and part of the converted BNB are deposited into the RLDM-BNB pool on pancakeswap as liquidity. For every `swapAndLiquify()` function call, a small amount of BNB is leftover in the contract. This is because the price of `RLDM` drops after swapping the first half of `RLDM` tokens into `BNB`, and the other half of `RLDM` tokens require less than the converted BNB to be paired with it when adding liquidity. The contract doesn't appear to provide a way to withdraw those BNB, and they will be locked in the contract forever.
Open the report`_swapAndLiquify()` is called whenever there is a buy, `swapAndLiquifyEnabled = true`, and `inSwapAndLiquify != true`. This can cause an increase in sell pressure as it dramatically increases the number of sells. In addition, it may call `_swapAndLiquify()` when there is very little or no liquidity to be added.
Open the reportThe variables `_totalTaxIfBuying`, `_totalTaxIfSelling`, and `_totalDistributionShares` are assigned both when the variables are defined and in the constructor.
Open the reportThe time-lock of 48 hours is started with an event stating that there was an ownership transfer request which gives the address of the newOwner and the `block.timestamp` when the ownership can be transferred. However, after the 48 hours a different `newOwner` could be given as an input when `transferOwnership()` is called so that the time-lock was initiated for one owner, but then ownership is assigned to another.
Open the reportPerforming integer division before multiplication truncates the low bits, losing the precision of calculation. This is done when calculating all of the total amounts for the initial distribution of tokens.
Open the reportBuys and sells are taxed, with the tax being broken into liquidity, marketing, and team fees. The percentages stored in these variables is not proportional to the amount of the total fees that gets distributed however. The liquidity, marketing, and team shares instead are used to calculate how the total fees are distributed when `swapAndLiquify()` is called. For example, upon construction liquidity fees account for 2/5 of the total fees. However, the liquidity share is only 1/6 of the total distribution of shares and as a result only approximately 1/6 of the total fees is used for liquidity.
Open the reportThe `public` functions: - `airdrop()` - `setMarketPairStatus()` - `setIsExcludedFromFee()` - `setSwapAndLiquifyEnabled()` - `setSwapAndLiquifyByLimitOnly()` - `changeRouterVersion()` are never called by the contract can be declared `external`. External functions can be more efficient than `public` functions.
Open the reportThere should always be events emitted in the sensitive functions that are controlled by centralization roles. The following functions are controlled by `_owner`: - `airdrop()` - `setMarketPairStatus()` - `setIsExcludedFromFee()` - `setBuyTaxes()` - `setSellTaxes()` - `setDistributionSettings()` - `setMarketingWalletAddress()` - `setTeamWalletAddress()` - `setSwapAndLiquifyByLimitOnly()` - `changeRouterVersion()`
Open the reportThe function `transferToAddressETH()` uses the built in `transfer()` function. There are potential issues with this as this forwards exactly 2300 gas and if the receiving contract has a `fallback` function or gas prices are changed, then the transaction may be reverted. See this [doc](https://ethereum.stackexchange.com/questions/19341/address-send-vs-address-transfer-best-practice-usage) for more details.
Open the reportThe `gnosisSafeProxy` is given ownership last in the constructor. This causes the `owner()` to be the zero address when used in the rest of the constructor. In addition, ownership is assigned by using the `_transferOwnership()` function that will start the 48 hour time-lock so that ownership can be transferred after 48 hours of contract deployment.
Open the reportIf `address(this)` is changed to not be excluded from fees, then with the current implementation the `swapAndLiquify` transaction can be taxed.
Open the report*This finding has a minor impact because the reentrancy only causes out-of-order events.* A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. In this case it is possible to reenter `changeRouterVersion()`, `transfer()`, and `transferFrom()` and emit events out of order if the router is changed to an untrusted contract controlled by an attacker.
Open the reportSolidity version >=0.8.0 includes checked arithmetic operations and underflow/overflow by default, making SafeMath redundant.
Open the reportLiterals with many digits are difficult to read and review.
Open the reportThe events `SwapAndLiquify` and `SwapETHForTokens` are declared but never used.
Open the reportThe import file `IUniswapV2Pair.sol` is never used in the contract.
Open the reportThe bool `swapAndLiquifyByLimitOnly` is defined, but is never used in the contract except in the function `setSwapAndLiquifyByLimitOnly` that is used to update the bool.
Open the reportThe variable `deadAddress` could be declared as `constant` because it is never modified.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="red-light-district-metaverse"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us