Read the findings of the 2022 Web3 Security Report

Currently, both the `owner` of the `tokenId` and the owner's operator can set authorization, but usually, only the `owner` of `tokenId` can set authorization.

Secondary Authorization

The start index is 0 when the first NFT is mint, while the index will be set to 0 when burned and the default index value is also zero.

Unsound Value for `idToIndex[_tokenId]`

When removing NFT, missing remove `idToOwnerIndex[_tokenId]`.

Dirty Data

In the contract `MetaElfLand`, the role `owner` has authority over the following functions:
- function mint()
- function renounceOwnership()
- function transferOwnership()

In the contract `zNFTCONTRACT`, the role `manager` has authority over the following functions:
- function mint() will mint NFT to anyone.
- function burn(() will burn anyone's NFT.
- function setStarall1()
- function setStarall2()
- function setStarall3()
- function setStarall4()
- function setStarall5()
- function setStarall6()

In the contract `zNFTCONTRACT`, the role `owner` has authority over the following functions:
- function addManager()
- function delManager()
- function transferOwnership()

In the contract `Consignment`, the role `governance` has authority over the following functions:
- function setGovernance()
- function setFee()
- function withdraw()
- function setNFTAddr()

Any compromise to these accounts may allow a hacker to take advantage of this authority.

Centralization Related Risks

`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.

Improper Usage of `public` and `external` Type

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing Emit Events

The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

Unlocked Compiler Version

In the current implementation, there is no upper limit for the fee rate. Misuse of these fee setting functions could damage the whole tokenomics. For example, the owner can set the fee rate to more than 100% to cause all transactions to revert.

No Upper Limit for `_fee`

The given input is missing the check for the non-zero address.

Missing Input Validation

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. 
If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. 
- function sell(uint _tokenid,uint _price)
- function cancelSell(uint _tokenid)
- function buy(uint _tokenid)

Potential Reentrancy Attack

These variables `_nftTypeInfo/_nftNameInfo/_nftURLInfo/_nftBrandInfo/_nftNumberingInfo` are never used.

Variables Never Used Can Be Removed

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

Missing Error Messages

The linked variables could be declared as `constant` since these state variables are never modified.

Variables That Could Be Declared as `constant`

All of the `MELT` tokens are sent to the contract deployer when deploying the contract. This could be a centralization risk as the deployer can distribute all tokens without obtaining the consensus of the community.

Initial Token Distribution

Literals with many digits are difficult to read and review.

File: Solidity/Token.sol (Line 355, Function `MetaElfLand.constructor`)
```solidity
    _totalSupply = 1000000000*1e8;
```



Too Many Digits

The internal function `_burnFrom` is not used.

Dead Code

MetaElfLand

Token.sol

NFT.sol

Store.sol

MetaElfLand 

Did Mark Zuckerberg’s Little Dance Actually Show Us Real Metaverse Legs? | Transparent NEWS

Trump’s NFT Digital Trading Cards Bring in Millions of Dollars—and GOP Ridicule - WSJ

Ethereum (ETH) Sees High Volatility as U.S. Records Higher-Than-Expected GDP Growth

Apple Wants to Play in the Metaverse. Don't Expect It to Be Easy.

BTC price struggles at $21K as trader says ‘top is in’ for Bitcoin, Ethereum

An auditor in the metaverse. No proper tracking of cash or employees. New FTX CEO describes Sam Bankman-Fried’s haphazard management.

Cardano Founder Makes Staggering Prediction about BTC, XRP May Make Everyone Cry, SHIB Metaverse Team Reveals Crucial Update: Crypto News Digest by U.Today

MetaElfLand

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

16

0

6

1

9