According to a medium article for this game, there are going to be X amount reserved for a vault. Are the VIP_WHITELIST reserved for vault?. Otherwise do you plan to add some extra logic to reserve some or any NFT's for it.

Potential Inconsistency In Tokenomics?

Lots of functions, variables, and lines of code throughout the contracts can be hard to follow. This could be mitigated by making it easier to read by using simpler methods.

For example: 
```solidity
bloodlineRatioPerCoreType[CoreType.Primal][Bloodline.Pure] = 100;
```
Could be shorted by using numbers to equal the variable so that each line is not hard and complex to follow. Such as:
```solidity
enum CoreType {
Elemental,
Mythic,
Arcane,
Divine,
Primal
}
```
Instead of this we could use numbers to assign these to and then comment out what the numbers represent. 

Unclear Variable Naming and Construction

The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

Unlocked Compiler Version

The function that affects the status of sensitive variables should be able to emit events as notifications to [users].

- `setBaseURI()`
- `setPlanetRelics()`


Missing Emit Events

It is now well understood that the difficulty or timestamp is not a source of randomness. They can be manipulated if the attacker is also a miner. The linked functions below have a possibility to be manipulated.

Potential Weak Random

`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.

Improper Usage of public and external Type

In the contract `[ApeironPlanet]`, the role `[PAUSER_ROLE]` has authority over the following functions:

- `pause()`
- `unpause()`

The role `[MINTER_ROLE]` has authority over the following functions:

- `safeMint()`
- `burn()`
- `updatePlanetData()`
- `setBaseURI()`

The role `[UPGRADER_ROLE]` has authority over the following functions: 

- `_authorizeUpgrade()`

The role `[DEFAULT_ADMIN_ROLE]` has authority over the following functions: 

-`setAdmin()` - This role has the biggest potential for risks and should be kept in cold storage and hardly ever used to avoid risks. The ability to set other admins has an immense risk for the entire project.


Any compromise to the `[MINTER_ROLE]`, `[PAUSER_ROLE]`, `[UPGRADER_ROLE]`, and `[DEFAULT_ADMIN_ROLE]` accounts may allow a hacker to take advantage of this.

Centralization Related Risks in `ApeironPlanet`

The function `initialize()` should only be callable by the governance account. Otherwise, after the contract deployment, a hacker can be the first to call this function and register malicious contracts, steal funds afterward.

Lack Of Access Restriction On Function `initialize()`

The following error message could be worded a little clearer:

```solidity=35
require(_exists(_tokenId), "tokenId is not existent");
```

Potential Typo

The following code snippet is a redundant declaration: 
```solidity
bytes32 constant PAUSER_ROLE = keccak256("PAUSER_ROLE"); //0x65d7a28e3265b37a6474929f336521b332c1681b933f6cb9f3376673440d862a
bytes32 constant MINTER_ROLE = keccak256("MINTER_ROLE"); //0x9f2df0fed2c77648de5860a4cc508cd0818c85b8b8a1ab4ceeef8d981c8956a6
bytes32 constant UPGRADER_ROLE = keccak256("UPGRADER_ROLE"); //0x189ab7a9244df0848122154315af71fe140f3db0fe014031783b0946b8c9d2e3
```

Redundant Code

The following modifier could be removed depending on use case of team. If the wrong URI is put in place, then you could change it while paused. In the current iteration, there is no such way to do this. We are wondering the use case of not allowing to change URI when paused.

Modifier Removal on Function `setBaseUri()`?

Attributes could have duplication due to lack of check.
```solidity
attributes[10] = _randomRange(0, 31); //skill: pskill1
attributes[11] = _randomRange(0, 31); //skill: pskill2
attributes[12] = _randomRange(0, 32); //skill: pskill3
attributes[13] = _randomRange(0, 32); //skill: pskill4
```

Potential Duplicate Attributes

In the contract `[ApeironPlanetPresaleFactory]`, the role `[onlyOwner]` and `[onlyAdmin]` have authority over the following functions:

- `withdrawFunds()`
- `setTypeCounter()`
- `setEnabled()`
- `setPurchaseLimits()`
- `whitelist()`
- `whitelistBatch()`
- `blacklist()`
- `blacklistBatch()`
- `setForSalesSchedule()`

Any compromise to the `[onlyOwner]` and `[onlyAdmin]` accounts may allow a hacker to take advantage of these functions. These functions have an immense amount of power of the presale and launch of the project. We recommend using a Gnosis safe to keep the contract as safe as possible. If the hacker gets a hold of the wallet, they could destroy the project on launch.

Centralization Related Risks in `ApreironPlanetPresaleFactory`

The linked variables are assigned only once, either during their contract-level declaration or during the `constructor`'s execution.

Mutability Specifiers Missing

The `for` loop in the function `whitelistBatch()` takes the unbounded array's length as the maximum. If the size of the array `whitelistTypes` grows large, iterating through the entire array could be an expensive operation. Even worse, if the computation for each iteration is extremely complex, it could potentially exceed the gas limit per block. 

The `for` loop in the function `blacklist()` takes an unbounded array's length as the maximum. If too many addresses are input at once, it could exceed gas limit per block.

Potential Resource Exhaustion

There is no "logical" issue with the code. The VIP's are able to purchase when their schedule is ready. They cannot purchase during regular whitelist purchases because of the different check on `ForSaleType`. 
```solidity
getCurrentForSaleType() == ForSaleType.ForWhitelist &&
_whitelisted[_msgSender()].whitelistType == WhitelistType.WHITELIST &&
```

Apeiron

Highlights & Alerts

Team Identity Verified By CertiK (KYC)

A Highly Centralized Project

Code Audit History

16

0

7

0

9

Skynet

Sentiment Analysis