Q1 2025 Web3 Security ReportAccess control failures led to $1.63 billion in losses
Discover report insights
  • Hacken
  • Audits
  • legends-of-elysium
  • [SCA] Legends of Elysium / NFT / Jan2024
Legends of Elysium logo

Legends of Elysium

Audit name:

[SCA] Legends of Elysium / NFT / Jan2024

Date:

Feb 21, 2024

Table of Content

→Introduction
→Audit Summary
→Document Information
→System Overview
→Executive Summary
→Risks
→Findings
→Appendix 1. Severity Definitions
→Appendix 2. Scope
→Disclaimer

Want a comprehensive audit report like this?

Introduction

We express our gratitude to the Legends of Elysium team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.

Legends of Elysium is a card game project composed by ERC1155 tokens with staking and vesting capabilities.

titlecontent
PlatformEVM
LanguageSolidity
TagsEVM
Timeline29/01/2024 - 15/02/2024
Methodologyhttps://hackenio.cc/sc_methodology→

    Review Scope

    Repositoryhttps://github.com/LegendsOfElysium→
    Commit6e2d8b2

    Audit Summary

    Total9.6/10
    Security Score

    10/10

    Test Coverage

    87.78%

    Code Quality Score

    10/10

    Documentation Quality Score

    10/10

    10Total Findings
    9Resolved
    1Accepted
    0Mitigated

    The system users should acknowledge all the risks summed up in the risks section of the report

    Document Information

    This report may contain confidential information about IT systems and the intellectual property of the Customer, as well as information about potential vulnerabilities and methods of their exploitation.

    The report can be disclosed publicly after prior consent by another Party. Any subsequent publication of this report shall be without mandatory consent.

    Document

    NameSmart Contract Code Review and Security Analysis Report for Legends of Elysium
    Audited ByNiccolò Pozzolini, Kornel Światłowski
    Approved ByPrzemyslaw Swiatowiec
    Website-
    Changelog08/02/2024 - Preliminary Report; 1502/2024 Second Review

    • Document

      Name
      Smart Contract Code Review and Security Analysis Report for Legends of Elysium
      Audited By
      Niccolò Pozzolini, Kornel Światłowski
      Approved By
      Przemyslaw Swiatowiec
      Website
      -
      Changelog
      08/02/2024 - Preliminary Report; 1502/2024 Second Review

    System Overview

    Legends of Elysium is a card game project composed by ERC1155 tokens with staking and vesting capabilities.

    Privileged roles

    • LoeNftStaking: allow ERC1155 tokens to be staked, update trusted forwarders;

    • PoolsBase: start vesting, transfer unlocked funds from the reserve pool to another pool or an EOA, create new pools, move locked funds between the pools, configure how received funds are split into the pools, set trusted forwarders;

    • Staking: set the ERC20 token address, set the staking start time, set the staking close time, and withdraw excess balance after rewards allocation;

    • Vesting: add vesting beneficiaries,  add vesting pools, and lock the contract so that tokens can be released.

    Executive Summary

    Documentation quality

    The total Documentation Quality score is 10 out of 10.

    • Functional requirements are complete.

    • Technical description is provided.

    Code quality

    The total Code Quality score is 10 out of 10.

    • The development environment is configured.

    Test coverage

    Code coverage of the project is 87.78%.

    • Deployment and basic user interactions are covered with tests.

    Security score

    Upon auditing, the code was found to contain 0 critical, 0 high, 0 medium, and 4 low severity issues. All issues were solved in the remediation part of an audit, leading to a security score of 10 out of 10.

    All identified issues are detailed in the “Findings” section of this report.

    Summary

    The comprehensive audit of the customer's smart contract yields an overall score of 9.6. This score reflects the combined evaluation of documentation, code quality, test coverage, and security aspects of the project.

    Risks

    LoeNftStaking, VoucherPayments and Pools make use of trusted forwarders: entities allowed by the admin to interact with these contracts on behalf of the users.

    Findings

    Code
    ―
    Title
    Status
    Severity
    F-2024-0771Bad Practice in Signature Uniqueness Checks
    fixed

    Low
    F-2024-0733Minting process of ERC721 tokens can be improved
    fixed

    Low
    F-2024-0729Missing checks for address(0)
    fixed

    Low
    F-2024-0723Unchecked Transfers Operations ERC20 Tokens
    fixed

    Low
    F-2024-0774Redundant Storage Write in TokenVesting.addBeneficiaries() Function
    fixed

    Observation
    F-2024-0773Redundant SafeMath
    fixed

    Observation
    F-2024-0769Redundant parameter in redeem() function
    accepted

    Observation
    F-2024-0735Increments can be unchecked in for-loops
    fixed

    Observation
    F-2024-0730Public Functions That Should Be External
    fixed

    Observation
    F-2024-0725Redundant imports
    fixed

    Observation
    1-10 of 10 findings

    Identify vulnerabilities in your smart contracts.

    Appendix 1. Severity Definitions

    When auditing smart contracts, Hacken is using a risk-based approach that considers Likelihood, Impact, Exploitability and Complexity metrics to evaluate findings and score severities.

    Reference on how risk scoring is done is available through the repository in our Github organization:

    Severity

    Description

    Critical
    		Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.

    High
    		High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.

    Medium
    		Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.

    Low
    		Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score.

    • Severity

      Critical

      Description

      Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.

      Severity

      High

      Description

      High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.

      Severity

      Medium

      Description

      Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.

      Severity

      Low

      Description

      Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score.

    Appendix 2. Scope

    The scope of the project includes the following smart contracts from the provided repository:

    Scope Details

    Repositoryhttps://github.com/LegendsOfElysium/contracts→
    Commit6e2d8b2aa7043588aba92234b0990c56b8ce20ab
    Whitepaper-
    Requirements-
    Technical RequirementsProvided in PDF document

    Contracts in Scope

    contracts
    nftstake
    LoeNftStaking.sol - contracts/nftstake/LoeNftStaking.sol
    payments
    VoucherPayments.sol - contracts/payments/VoucherPayments.sol
    pools
    Deposit.sol - contracts/pools/Deposit.sol
    LoePools.sol - contracts/pools/LoePools.sol
    PoolsBase.sol - contracts/pools/PoolsBase.sol
    staking
    Staking.sol - contracts/staking/Staking.sol
    vesting
    Vesting.sol - contracts/vesting/Vesting.sol
    nfts
    LoeHero.sol - contracts/nfts/LoeHero.sol
    LoeCard.sol - contracts/nfts/LoeCard.sol
    LoeCardBack.sol - contracts/nfts/LoeCardBack.sol
    ERC1155VoucherMintableBurnable.sol - contracts/nfts/ERC1155VoucherMintableBurnable.sol
    ERC721VoucherMintableBurnable.sol - contracts/nfts/ERC721VoucherMintableBurnable.sol
    metatx
    ContextStorage.sol - contracts/metatx/ContextStorage.sol

    Disclaimer