Q2 2026 Security & Compliance Report67 incidents, $764M in losses, 88% from operational failures.
Get the report →
Trailblaze logo

Trailblaze

Audit name:

[SCA] Trailblaze | Launchpad | Mar2024

Date:

Apr 5, 2024

Table of Content

→Introduction
→Audit Summary
→Document Information
→System Overview
→Executive Summary
→Risks
→Findings
→Appendix 1. Severity Definitions
→Appendix 2. Scope
→Disclaimer

Want a comprehensive audit report like this?

Introduction

We express our gratitude to the Trailblaze team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.

MightyLabs launchpad (aka. Trailblaze) is a launchpad platform for web3 projects that will facilitate launches of cryptocurrency tokens (Token Generation Events - TGE’s) as well as offer a section dedicated to NFTs - discovering and minting new projects directly from the platform.

titlecontent
PlatformEVM
LanguageSolidity
TagsStaking, Liquidity Pool
Timeline13/03/2024 - 04/04/2024
Methodologyhttps://hackenio.cc/sc_methodology→

    Review Scope

    Repositoryhttps://github.com/Boris-/Trailblaze-Contracts→
    Commit44722e69d25d343d235223ac1cca2c1aa7755753

    Audit Summary

    Total9.7/10
    Security Score

    10/10

    Test Coverage

    92.62%

    Code Quality Score

    10/10

    Documentation Quality Score

    10/10

    6Total Findings
    6Resolved
    0Accepted
    0Mitigated

    The system users should acknowledge all the risks summed up in the risks section of the report

    Document Information

    This report may contain confidential information about IT systems and the intellectual property of the Customer, as well as information about potential vulnerabilities and methods of their exploitation.

    The report can be disclosed publicly after prior consent by another Party. Any subsequent publication of this report shall be without mandatory consent.

    Document

    NameSmart Contract Code Review and Security Analysis Report for Trailblaze
    Audited ByMaksym Fedorenko, Roman Tiutiun
    Approved ByGrzegorz Trawinski
    Websitehttps://hacken.io→
    Changelog19/03/2024 - Preliminary Report; 04/04/2024 - Final Report

    • Document

      Name
      Smart Contract Code Review and Security Analysis Report for Trailblaze
      Audited By
      Maksym Fedorenko, Roman Tiutiun
      Approved By
      Grzegorz Trawinski
      Website
      https://hacken.io→
      Changelog
      19/03/2024 - Preliminary Report; 04/04/2024 - Final Report

    System Overview

    MightyLabs launchpad (aka. Trailblaze) is a launchpad platform for web3 projects that will facilitate launches of cryptocurrency tokens (Token Generation Events - TGE’s) as well as offer a section dedicated to NFTs - discovering and minting new projects directly from the platform. with the following contracts:

    IdoPool.sol — a contract allowing users to buy tokens using Ether or other ERC20 tokens within time limits. Users can later claim purchased tokens or request refunds. The contract's owner can adjust sale parameters and manage the offering process.

    IdoPoolFactory.sol — a contract factory for creating pools.

    Staking.sol — a contract that allows users to lock and unlock tokens and NFTs, with specific cooldown periods for withdrawals. The amount of the locked tokens and the NFTs affect the “score” of the users within the contract.

    Privileged roles

    • The owner of the IdoPool.sol contract can arbitrarily set the token amount for sale, set the open time, set the close time, and refund the remaining tokens.

    • The owner of the Staking.sol contract can arbitrarily set accepted tokens, set cooldown period, set maximum nft staking, and set multiplier.

    Executive Summary

    Documentation quality

    The total Documentation Quality score is 10 out of 10.

    Code quality

    The total Code Quality score is 10 out of 10.

    Test coverage

    Code coverage of the project is 92.62% (branch coverage)

    • Deployment and basic user interactions are covered with tests.

    • Interactions by several users are tested thoroughly.

    Security score

    Upon auditing, the code was found to contain 0 critical, 0 high, 2 medium, and 0 low severity issues, leading to a security score of 8 out of 10. Upon the retest, all issues were fixed resulting in the final score of 10 out of 10.

    All identified issues are detailed in the “Findings” section of this report.

    Summary

    The comprehensive audit of the customer's smart contract yields an overall score of 9.7. This score reflects the combined evaluation of documentation, code quality, test coverage, and security aspects of the project.

    Scoring Methodologyarrow right

    Risks

    The Owner of the Staking contract and might affect the withdrawal tokens, max amount of NFT to lock, if the wrong values are specified it might affect, sometimes block the locked funds.

    The Owner of the Staking contract specifies the weights which affect the user total points.

    The IDO contract might lack the amount of the tokens which is required for withdrawals.

    The Owner of the IDO might affect the end time of the IDO.

    Findings

    F-2024-1564Use of tx.origin
    Status
    fixed
    Severity

    Medium
    F-2024-1561Admin Might Update The Staking Withdrawing Tokens During The Staking
    Status
    fixed
    Severity

    Medium
    F-2024-1570Wrong NatSpec For The State Variable
    Status
    fixed
    Severity

    Observation
    F-2024-1569EIP712 Signature Violations
    Status
    fixed
    Severity

    Observation
    F-2024-1565Missing Validation For Crucial State Changes
    Status
    fixed
    Severity

    Observation
    F-2024-1536Commented Code Part
    Status
    fixed
    Severity

    Observation
    Code
    ―
    Title
    Status
    Severity
    F-2024-1564Use of tx.origin
    fixed

    Medium
    F-2024-1561Admin Might Update The Staking Withdrawing Tokens During The Staking
    fixed

    Medium
    F-2024-1570Wrong NatSpec For The State Variable
    fixed

    Observation
    F-2024-1569EIP712 Signature Violations
    fixed

    Observation
    F-2024-1565Missing Validation For Crucial State Changes
    fixed

    Observation
    F-2024-1536Commented Code Part
    fixed

    Observation
    1-6 of 6 findings

    Identify vulnerabilities in your smart contracts.

    Appendix 1. Severity Definitions

    When auditing smart contracts, Hacken is using a risk-based approach that considers Likelihood, Impact, Exploitability and Complexity metrics to evaluate findings and score severities.

    Reference on how risk scoring is done is available through the repository in our Github organization:

    Severity

    Description

    Critical
    		Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.

    High
    		High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.

    Medium
    		Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.

    Low
    		Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score.

    • Severity

      Critical

      Description

      Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.

      Severity

      High

      Description

      High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.

      Severity

      Medium

      Description

      Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.

      Severity

      Low

      Description

      Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score.

    Appendix 2. Scope

    The scope of the project includes the following smart contracts from the provided repository:

    Primary Scope Details

    Repositoryhttps://github.com/Boris-/Trailblaze-Contracts→
    Commit44722e69d25d343d235223ac1cca2c1aa7755753
    WhitepaperMightyLauchpad_TechnicalDocument→
    RequirementsMightyLauchpad_TechnicalDocument→
    Technical RequirementsMightyLauchpad_TechnicalDocument→

    Secondary Scope Details

    Repositoryhttps://github.com/Boris-/Trailblaze-Contracts→
    Commit6fc48b2d31b32ca2f0eae5b394c2dc3cb1c2efbe
    WhitepaperMightyLauchpad_TechnicalDocument→
    RequirementsMightyLauchpad_TechnicalDocument→
    Technical RequirementsMightyLauchpad_TechnicalDocument→

    Contracts in Scope

    contracts
    ido
    IdoPool.sol - contracts › ido › IdoPool.sol
    IdoPoolFactory.sol - contracts › ido › IdoPoolFactory.sol
    interfaces
    IPool.sol - contracts › ido › interfaces › IPool.sol
    staking
    Staking.sol - contracts › staking › Staking.sol

    Disclaimer