10k+

5k - 10k

1k - 5k

100 - 1k

0 - 100

<1 Month

1-3 Months

3-6 Months

6 Months -1 Year

1 -2 Years

2 -3 Years

> 3 Years

Sign Up for a Code Audit Today and Get 3 Months of Skynet for Free

Dojoswap

Numbers Protocol 

RMAI

Metaverse VR 

QUINT

SPY 

In the contract, `Listing`, the role, `owner`, has authority over the functions shown in the diagram below.

Any compromise to the `owner` account may allow the hacker to take advantage of this authority and switch owner, and modify critical configurations of the contract.

![](https://accelerator-tasks-prod.s3.amazonaws.com/da18cc6078c245d5960aebdacfd4da6b/Listing-owner.svg)

In the contract, `Listing`, the role, `tokenContract`, has authority over the functions shown in the diagram below.

Any compromise to the `tokenContract` account may allow the hacker to take advantage of this authority and switch owner, and modify critical configurations of the contract.

![](https://accelerator-tasks-prod.s3.amazonaws.com/da18cc6078c245d5960aebdacfd4da6b/Listing-tokenContract.svg)

In the contract, `Listing`, the role, `validator`, has authority over the functions shown in the diagram below.

Any compromise to the `validator` account may allow the hacker to take advantage of this authority and switch owner, and modify critical configurations of the contract.

![](https://accelerator-tasks-prod.s3.amazonaws.com/da18cc6078c245d5960aebdacfd4da6b/Listing-validator.svg)

Centralization Risk in Listing.sol

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing emit events

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.

Variables that could be declared as immutable

```js==
 79      * For example A, B, C, D are options. Ar, Br, Cr, Dr are the reward values respectively
 80      * The validator should set up the option carefully, so Ar + Br + Cr + Dr = 100
 81      */
 82     function setupOptionReward (uint256 _optionId, uint256 _reward) public onlyValidator {
 83         require(_reward <= 100, "Listing: Invalid reward value");
 84         options[_optionId]._reward = _reward;
 85         options[_optionId]._isSet = true;
 86     }
```

This is no check in the code to make sure "Ar + Br + Cr + Dr = 100"

Inconsistent Comments and Code

The linked `transfer()`/`transferFrom()` invocations do not check the return value of the function call which should yield a `true` result in case of proper ERC-20 implementation.


Unchecked Value of ERC-20 `transfer()`/`transferFrom()` Call

In the contract, `Token`, the role, `BURNER`, has authority over the function:
- burn()

Any compromise to the `BURNER` account may allow the hacker to take advantage of this authority and burn tokens of the contract.

In the contract, `Token`, the role, `MINTER`, has authority over the function:
- mint()

Any compromise to the `MINTER` account may allow the hacker to take advantage of this authority and mint new tokens of the contract.

In the contract, `Token`, the role, `DEFAULT_ADMIN_ROLE,`, has authority over the function:
- emergencyUpdateListingValidator()
- updateStakingAddress()

Any compromise to the `DEFAULT_ADMIN_ROLE,` account may allow the hacker to take advantage of this authority and modify critical configurations of the contract.


Centralization Risk in token.sol

`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.

ANFT Token

Highlights & Alerts

A Highly Centralized Project

Code Audit History

7

0

1

1

5

Skynet

Social Analysis

Twitter Social Reach Data

Governance & Autonomy

Holder Cohort Daily Analysis

Skynet Median Holder Distribution

Skynet Token Age Distribution