Read the findings of the 2022 Web3 Security Report

In the contract `MNSNFT` and `GenesisAvatarNFT`, the state variable `merkleRoot` stands for an off-chain Merkle tree, which is used to verify whether a given user has the privilege to buy the NFT in the whitelisted sale. However, the actual Merkle tree used by the contract is uncertain and can be changed. Normally, the Merkle tree is used to prevent arbitrary change to the nodes, but the contracts allow direct updates to the Merkle tree root, which can change the whole tree. Also, there is no on-chain view method for the users to check whether they are included in the Merkle tree. This may cause confusion among users.

What's more, in the function `buy()` and `buyUseMeta()`, the parameter `merkleProof` is passed in to verify whether the `msg.sender` is in the Merkle tree. So the actual value is uncertain and malicious users can perform a second preimage attack.

We would like to confirm with the client if the current implementation aligns with the original project design.

Unknown Merkle tree and parameter `merkleProof`

`public` functions that are never called by the contract could be declared `external`. When the inputs are arrays, `external` functions are more efficient than `public` functions.

Function Visibility Optimization

Functions that affect the status of sensitive variables should be able to emit events as notifications to customers.

Missing Emit Events

The linked statements do not affect the functionality of the codebase and appear to be either leftovers from test code or older functionality.

Redundant Code Components

In the contract `GenesisAvatarNFT` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/8d722640e7194cb2ac9284bb6a4a9bcb/diagrams/centralization-GenesisAvatarNFT-_owner.svg)

Centralization Risk in GenesisAvatarNFT.sol

There are two functions in the contract modified by `onlyOwner`, but setting the same variable `avatarPrice`.

Discussion For Function `setAvatarPrice()` and `setPrice()`

In the contract `MNSNFT` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/8d722640e7194cb2ac9284bb6a4a9bcb/diagrams/centralization-MNSNFT-_owner.svg)

In the contract `Ownable` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/8d722640e7194cb2ac9284bb6a4a9bcb/diagrams/centralization-Ownable-_owner.svg)

Centralization Risk in MNSNFT.sol

No check is made when converting from `uint256` to `uint64`. 

Unsafe Conversion from `uint256` to `uint64`

The given input is missing the check for the non-zero address.

Lack of Zero Address Validation

The function `valid()` returns true when the higher part has 0 bits, and the function `lower()` returns when the byte has 0 bits, the same applies to the function `bytes32ToString()`. So in the end, only the none-0-bit parts before the first 0-bit of variable `_nickName` are saved, while the following will be reset to 0.

```solidity
_nickName = '0x3140310000000000000000000000000000000000000000000000000000000000'
string(_nickName) = '1@1'
valid(_nickName) = false
lower(_nickName) = '0x3140310000000000000000000000000000000000000000000000000000000000'
bytes32ToString(_nickName) = '1@1'
```

```solidity
_nickName = '0x0040310000000000000000000000000000000000000000000000000000000000'
string(_nickName) = '@1'
valid(_nickName) = true
lower(_nickName) = '0x0000000000000000000000000000000000000000000000000000000000000000' 
bytes32ToString(_nickName) = ''
```

```solidity
_nickName = '0x3100310000000000000000000000000000000000000000000000000000000000'
string(_nickName) = '11'
valid(_nickName) = true
lower(_nickName) = '0x3100000000000000000000000000000000000000000000000000000000000000' 
bytes32ToString(_nickName) = '1'
```

Discussion For Function `valid()`

Metalk DAO

GenesisAvatarNFT.sol

MNSNFT.sol

Metalk DAO 

Phishing scammer Monkey Drainer has pilfered as much as $1M in Ethereum

Did Mark Zuckerberg’s Little Dance Actually Show Us Real Metaverse Legs? | Transparent NEWS

Ethereum (ETH) Sees High Volatility as U.S. Records Higher-Than-Expected GDP Growth

Apple Wants to Play in the Metaverse. Don't Expect It to Be Easy.

BTC price struggles at $21K as trader says ‘top is in’ for Bitcoin, Ethereum

An auditor in the metaverse. No proper tracking of cash or employees. New FTX CEO describes Sam Bankman-Fried’s haphazard management.

Cardano Founder Makes Staggering Prediction about BTC, XRP May Make Everyone Cry, SHIB Metaverse Team Reveals Crucial Update: Crypto News Digest by U.Today

Metalk DAO

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

10

0

2

1

7