# MetaZero Omnichain NFTs audit Three Sigma · Omnichain RWA tokenisation · 27th January 2024 A private security review of Metazero (omnichain RWA tokenisation), conducted with Three Sigma and completed on 27th January 2024 over 4 days. 0xSimao disclosed 16 findings: 4 high severity, 3 medium, 3 low and 6 informational. ## What Metazero is MetaZero is a synthetic liquidity layer for omnichain tokenisation of gaming real-world assets, powered by LayerZero: game-guild assets are minted as NFTs and tokens whose supply and movement span several networks. ## Scope This first round covered the omnichain NFT and token contracts: minting including the genesis batch, cross-chain sends through LayerZero peers, tokenisation access control and burns, and the event surface integrators rely on. ## High severity findings - [NFTs can be stolen by calling send() and receiving the nfts in another chain](https://0xsimao.com/findings/metazero-i-stolen-send-receiving-nfts) - [deTokenize() is missing access control, anyone can burn other people's nfts](https://0xsimao.com/findings/metazero-i-tokenize-access-control-burn) - [Send should revert if the gas limit has not been set for a destination chain (peer)](https://0xsimao.com/findings/metazero-i-revert-gas-destination-peer) - [Lost nfts due to smart wallets having different addresses on different chains](https://0xsimao.com/findings/metazero-i-nfts-wallets-having-addresses) ## Medium severity findings - [mintGenesis() mints with a push pattern using _mint() which may lead to lost tokens](https://0xsimao.com/findings/metazero-i-mint-genesis-mints-push) - [In function mint() and lzReceive(), _safeMint() is recommended over _mint(), which performs additional checks](https://0xsimao.com/findings/metazero-i-mint-recommended-performs-additional) - [Can not mint 1000 tokens, only 999](https://0xsimao.com/findings/metazero-i-mint-1000-tokens-999) ## Low severity findings - [Important events are missing](https://0xsimao.com/findings/metazero-i-important-events-missing) - [renounceOwnership() should be disabled if it is not intended to be ever used](https://0xsimao.com/findings/metazero-i-renounce-ownership-intended-ever) - [Ownable2Step should be preferred over Ownable](https://0xsimao.com/findings/metazero-i-ownable2-step-preferred-ownable) ## Informational findings - [genesisMint gas costs can be reduced by caching genesisCounter](https://0xsimao.com/findings/metazero-i-mint-gas-caching-counter) - [_setDefaultRoyalty() in the constructor is overriding the BasicRoyalties constructor](https://0xsimao.com/findings/metazero-i-default-royalty-overriding-royalties) - [Unused parameters names can be removed to ignore compiler warnings](https://0xsimao.com/findings/metazero-i-names-ignore-compiler-warnings) - [Hardcoded variables should be placed as constants](https://0xsimao.com/findings/metazero-i-hardcoded-variables-placed-constants) - [genesisLimit can be placed as constant variables to save gas.](https://0xsimao.com/findings/metazero-i-genesis-placed-constant-gas) - [pragma abicoder v2; is enforced for solidity versions above 0.8.0](https://0xsimao.com/findings/metazero-i-pragma-abicoder-enforced-versions) ## The report [Download the report (PDF)](https://0xsimao.com/reports/2024-01-27-metazero-i.pdf)