WEBTHREE

®

Scope of Work

The scope of this audit is based on the material provided by the client. The goal of this audit is to ensure the following:

  • Find potential exploits for the contract
  • Find issues in the contract that will affect the integrity of the mint
  • Ensure the contract adheres to the business logics provided by the client
The logic of the contract will be compared to the business logic provided in the materials provided below:
  • CRFTD is a factory that deploys ERC721 Contracts
  • CRFTD has multiple phases; each phase has a price, maxSupply, mintedSupply, maxPerWallet, isActive and merkleRoot
  • CRFTD can be soulbound; if so it will not allow transfers
  • CRFTD public has a wallet limit and public price
  • CRFTD fees are based on mint price, if greater than 0.05 ether than charged additional 3% fee per mint + flat fee of 0.00089 eth
The contract was provided on 23rd May 2023 and audit was delivered on 30th May 2023. It was given in the following formats:

Disclaimer

This is a limited report based on our analysis of the Smart Contract audit and performed in accordance with best practices as of the date of this report, in relation to cybersecurity vulnerabilities and issues in the smart contract source code analyzed, the details of which are set out in this report, (hereinafter “Source Code”) and the Source Code compiling, deploying and performing the intended functions. In order to get a full view of our findings and the scope of our analysis, it is crucial for you to read the full report. While we have done our best in conducting our analysis and producing this report, it is important to note that you should not rely on this report and cannot claim against us on the basis of what it says or doesn’t say, or how we produced it, and it is important for you to conduct your own independent investigations before making any decisions.

By reading this report or any part of it, you agree to the terms of this disclaimer. If you do not agree to the terms, then you must immediately cease reading this report, and delete and destroy any and all copies of this report downloaded and/or printed by you. This report is provided for information purposes only and on a non-reliance basis and does not constitute investment advice. No one shall have any right to rely on the report or its contents and the individuals and/or team providing this report owe no duty of care towards you or any other person, nor does the individuals and/or team make any warranty or representation to any person on the accuracy or completeness of the report. The report is provided “as is” without any conditions, warranties, or other terms of any kind except as set out in this disclaimer and the individuals and/or team hereby exclude all representations, warranties, conditions and other terms (including without limitations, the warranties implied by law of satisfactory quality, fitness for purpose and the use of reasonable care and skill) which, but for this clause might have effect in relation to the report.

Except and only to the extend that it is prohibited by law, the individuals and/or team hereby exclude all liability and responsibility, and neither you nor any other person shall have any claim against the individuals and/or team for any amount of kind of loss or damage that may result to you or any other person including without limitation, any direct, indirect, special, punitive, consequential, or pure economic loss or damages, or any loss of income, profits, goodwill, data, contracts, use of money, or business interruption and whether in delict, tort (including without limitation negligence), contract, breach of statutory duty, misrepresentation (whether innocent or negligent) or otherwise under any claim of any nature whatsoever in any jurisdiction) in any way arising from or connected with this report and the use, inability to use or the results of use of this report and an reliance on this report.

Summary

Audited by:
ZooperDooper
Contract looks great and has all its bases covered; its clear developer is very knowledgeable and has written extensive documentations and tests which helps immensely with the auditing. It was hard to find fault within the contract and most of the findings are small gas improvements or informational which are mostly marginal in terms of improvements. Overall, great work and best of luck to your launch.
FINDINGS
0 Critical Issues
0 Medium Issues
0 Low Issues
7 Nits
KEY
Critical Issues
Medium Issues
Low Issues
Nits / Informational

Issues

Nits
Public max limit applies to all those who minted in presale stages

Not sure if intended, but those who mint in presale stages are limited to what they can mint in public.

Issues

Nits
Gas Improvement

(_numberMinted(user) + quantity > maxPerWallet && maxPerWallet != 0) short circuit it by (maxPerWallet != 0 && _numberMinted(user) + quantity > maxPerWallet )

Issues

Nits
Gas Improvement

Destructure PhaseSetting storage phase = phaseSettings[index]; and avoid reading multiple slots

Issues

Nits
Gas Improvement

uint256 mintValue = price_ * quantity_; set it earlier and use for additionalFee

Issues

Nits
revealTokenURI is redundant as setBaseURI can be set whenever

The intentions seems to be to reveal and avoid letting user to reveal again, however this can be superceded by setBaseURI so it seems redundant to have both

Issues

Nits
_MAX_BPS

MAX_BPS is not being used in factory and can be removed

Issues

Nits
PREREVAL_ENABLED_FLAG typo

Fix type to PREREVEAL_ENABLED_FLAG or just remove entirely as suggested in above