MetaZero Omnichain NFTs audit
A private security review of Metazero (omnichain RWA tokenisation), conducted with Three Sigma and completed on 27th January 2024 over 4 days. 0xSimao disclosed 16 findings: 4 high severity, 3 medium, 3 low and 6 informational.
What Metazero is
MetaZero is a synthetic liquidity layer for omnichain tokenisation of gaming real-world assets, powered by LayerZero: game-guild assets are minted as NFTs and tokens whose supply and movement span several networks.
Scope
This first round covered the omnichain NFT and token contracts: minting including the genesis batch, cross-chain sends through LayerZero peers, tokenisation access control and burns, and the event surface integrators rely on.
High severity findings
- NFTs can be stolen by calling send() and receiving the nfts in another chain
- deTokenize() is missing access control, anyone can burn other people's nfts
- Send should revert if the gas limit has not been set for a destination chain (peer)
- Lost nfts due to smart wallets having different addresses on different chains
Medium severity findings
- mintGenesis() mints with a push pattern using _mint() which may lead to lost tokens
- In function mint() and lzReceive(), _safeMint() is recommended over _mint(), which performs additional checks
- Can not mint 1000 tokens, only 999
Low severity findings
- Important events are missing
- renounceOwnership() should be disabled if it is not intended to be ever used
- Ownable2Step should be preferred over Ownable
Informational findings
- genesisMint gas costs can be reduced by caching genesisCounter
- _setDefaultRoyalty() in the constructor is overriding the BasicRoyalties constructor
- Unused parameters names can be removed to ignore compiler warnings
- Hardcoded variables should be placed as constants
- genesisLimit can be placed as constant variables to save gas.
- pragma abicoder v2; is enforced for solidity versions above 0.8.0
The report