Voxel X Network security record
As of 3 Nov 2026, Voxel X Network has 1 audit report on Trustblock, by CertiK, dated 19 Jul 2022. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| SuperKluster | Security firm: CertiK | Date: | Scope: Files named in the report | 1 critical finding, fixed | Open · skynet.certik.com |
Findings14
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 1 | 0 | 3 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 0 | 8 |
CriticalNo Initialization for VariableSuperKluster · CertiK · 19 Jul 2022Fixed
The `marketplace` is never initialized, so the functions `mintItem()` and `setTokenURI()` can never be invoked.
Open the reportHighIncomplete Signature CheckSuperKluster · CertiK · 19 Jul 2022Fixed
The checked signature is generated using only the first items of input parameters. The caller may alter the remaining parameters to take advantage of the system.
Open the reportHighNo Check On The Token OwnerSuperKluster · CertiK · 19 Jul 2022Fixed
This function doesn't check if the token blongs to the `mgs.sender`.
Open the reportHighTotal Price Irrelevant With `_quantity`SuperKluster · CertiK · 19 Jul 2022Fixed
The total tokens paid is currently determined by `_price` and irrelevant to the input quantity. Therefore the `_price` input seems to represent the total price of a purchase rather than the item price per NFT.
Open the reportMediumRoyalty for ERC1155 Does Not Scale With `quantitySuperKluster · CertiK · 19 Jul 2022Fixed
The royalty fee of ERC1155 in a deal is determined by the `_price` as unit price for token of a particular id alone and does not scale with the purchasing quantity.
Open the reportLowFunction Visibility OptimizationSuperKluster · CertiK · 19 Jul 2022Fixed
The following functions are declared as `public`, contain array function arguments, and are not invoked in any of the contracts contained within the project's scope. The functions that are never called internally within the contract should have external visibility.
Open the reportLowLack of Input ValidationSuperKluster · CertiK · 19 Jul 2022Fixed
`serviceFee` should not reach 100 percent.
Open the reportLowMissing Emit EventsSuperKluster · CertiK · 19 Jul 2022Fixed
There should always be events emitted in the sensitive functions that are controlled by centralization roles.
Open the reportLowMissing Error MessagesSuperKluster · CertiK · 19 Jul 2022Fixed
The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.
Open the reportLowPotential ReentrancySuperKluster · CertiK · 19 Jul 2022Fixed
A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. ### External call(s) ```solidity=600 _mint(account, tokenId, supply, ""); ``` * This function call executes the following external call(s). * In `ERC1155._doSafeTransferAcceptanceCheck`, * `IERC1155Receiver(to).onERC1155Received(operator,from,id,amount,data)` * This call sends Ether. ### State variables written after the call(s) ```solidity=605 _setApprovalForAll(account, _msgSender(), true); ``` * This function call executes the following assignment(s). * In `ERC1155._setApprovalForAll`, * `_operatorApprovals[owner][operator] = approved` --- ### External call(s) ```solidity=442 _safeMint(account, tokenId); ``` * This function call executes the following external call(s). * In `ERC721._checkOnERC721Received`, * `IERC721Receiver(to).onERC721Received(_msgSender(),from,tokenId,_data)` * This call sends Ether. ### State variables written after the call(s) ```solidity=446 _setApprovalForAll(account, _msgSender(), true); ``` * This function call executes the following assignment(s). * In `ERC721._setApprovalForAll`, * `_operatorApprovals[owner][operator] = approved` ```solidity=443 _setTokenURI(tokenId, tokenURI_); ``` * This function call executes the following assignment(s). * In `SK721Collection._setTokenURI`, * `_tokenURIs[tokenId] = tokenURI_`
Open the reportShow 3 more
LowSusceptible to Signature MalleabilitySuperKluster · CertiK · 19 Jul 2022Fixed
The signature malleability is possible within the Elliptic Curve cryptographic system. An Elliptic Curve is symmetric on the X-axis, meaning two points can exist with the same `X` value. In the `r`, `s`, and `v` representation this permits us to carefully adjust `s` to produce a second valid signature for the same `r`, thus breaking the assumption that a signature cannot be replayed in what is known as a replay attack.
Open the reportLowUse of `addItem()` and `buyItem()`SuperKluster · CertiK · 19 Jul 2022Fixed
For add and buy operations, all relevant parameters are provided by the user and validated through the center-controlled signer key. There are no checks on price in the functions and the validity of purchase seems to rely on the signing procedures. Besides, unlike `buyItem()`, there is a check to only allow listed SKCollection.
Open the reportLowVariables That Could Be Declared as `constant`SuperKluster · CertiK · 19 Jul 2022Fixed
The linked variables could be declared as `constant` since these state variables are never modified.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="voxel-x-network"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us