Generated 2026-08-12 05:33 UTC | 41 findings
Medium
5
Low
10
Gas
15
Informational
11
| ID | Finding | Instances |
|---|---|---|
| M-1 | `block.number` means different things on different L2s | 5 |
| M-2 | Centralization Risk for trusted owners | 24 |
| M-3 | `_safeMint()` should be used rather than `_mint()` wherever possible | 1 |
| M-4 | Using `transferFrom` on ERC721 tokens | 1 |
| M-5 | Direct `supportsInterface()` calls may cause caller to revert | 9 |
| ID | Finding | Instances |
|---|---|---|
| L-1 | Use a 2-step ownership transfer pattern | 3 |
| L-2 | External call recipient may consume all transaction gas | 10 |
| L-3 | Fallback lacking `payable` | 1 |
| L-4 | Initializers could be front-run | 40 |
| L-5 | Signature use at deadlines should be allowed | 5 |
| L-6 | Use `Ownable2Step.transferOwnership` instead of `Ownable.transferOwnership` | 1 |
| L-7 | Unsafe ERC20 operation(s) | 1 |
| L-8 | Unsafe solidity low-level call can cause gas grief attack | 1 |
| L-9 | Upgradeable contract is missing a `__gap[50]` storage variable to allow for new storage variables in | 108 |
| L-10 | Upgradeable contract not initialized | 163 |
| ID | Finding | Instances |
|---|---|---|
| GAS-1 | Use ERC721A instead ERC721 | 1 |
| GAS-2 | Don't use `_msgSender()` if not supporting EIP-2771 | 1 |
| GAS-3 | `a = a + b` is more gas effective than `a += b` for state variables (excluding arrays and mappings) | 13 |
| GAS-4 | Using bools for storage incurs overhead | 3 |
| GAS-5 | Cache array length outside of loop | 3 |
| GAS-6 | For Operations that will not overflow, you could use unchecked | 292 |
| GAS-7 | Use Custom Errors instead of Revert Strings to save Gas | 7 |
| GAS-8 | Avoid contract existence checks by using low level calls | 1 |
| GAS-9 | Functions guaranteed to revert when called by normal users can be marked `payable` | 46 |
| GAS-10 | `++i` costs less gas compared to `i++` or `i += 1` (same for `--i` vs `i--` or `i -= 1`) | 9 |
| GAS-11 | Using `private` rather than `public` for constants, saves gas | 7 |
| GAS-12 | Use shift right/left instead of division/multiplication if possible | 1 |
| GAS-13 | Splitting require() statements that use && saves gas | 6 |
| GAS-14 | Increments/decrements can be unchecked in for-loops | 26 |
| GAS-15 | Use != 0 instead of > 0 for unsigned integer comparison | 17 |
| ID | Finding | Instances |
|---|---|---|
| NC-1 | `constant`s should be defined rather than using magic numbers | 21 |
| NC-2 | Control structures do not follow the Solidity Style Guide | 95 |
| NC-3 | Critical Changes Should Use Two-step Procedure | 3 |
| NC-4 | Dangerous `while(true)` loop | 1 |
| NC-5 | Consider disabling `renounceOwnership()` | 2 |
| NC-6 | Functions should not be longer than 50 lines | 333 |
| NC-7 | Use a `modifier` instead of a `require/if` statement for a special `msg.sender` actor | 19 |
| NC-8 | `address`s shouldn't be hard-coded | 1 |
| NC-9 | Take advantage of Custom Error's return value property | 1 |
| NC-10 | Avoid the use of sensitive terms | 21 |
| NC-11 | Variables need not be initialized to zero | 13 |