# MetaZero Staking audit Three Sigma · Omnichain RWA tokenisation · 6th April 2024 A private security review of Metazero (omnichain RWA tokenisation), conducted with Three Sigma and completed on 6th April 2024 over 3 days. 0xSimao disclosed 10 findings: 2 high severity, 3 low and 5 informational. ## What Metazero is MetaZero is a synthetic liquidity layer for omnichain tokenisation of gaming real-world assets, powered by LayerZero. Its staking contract has MetaZero tokens staked for reward emissions. ## Scope The second Three Sigma round covered the staking contract: when reward accumulation starts, how partial unstakes settle, and whether the yield curve pays out what the emission schedule promises. ## High severity findings - [feesAccrued or staker principal may be sent as rewards if rewardRate and emissionEnd are not properly calculated](https://0xsimao.com/findings/metazero-ii-fees-rewards-reward-properly) - [Increasing emissionEnd after the previous emissionEnd ended will yield full rewards according to newEmissionEnd - prevEmissionEnd](https://0xsimao.com/findings/metazero-ii-yield-full-rewards-according) ## Low severity findings - [getRemainingUnstakeTime() returns 0 if user has not unstaked](https://0xsimao.com/findings/metazero-ii-remaining-unstake-returns-unstaked) - [emissionStart has no effect, rewards will start accumulating starting on the first staker](https://0xsimao.com/findings/metazero-ii-effect-rewards-accumulating-starting) - [Missing some events](https://0xsimao.com/findings/metazero-ii-missing-events) ## Informational findings - [Variables should be cached to memory to save gas](https://0xsimao.com/findings/metazero-ii-variables-cached-memory-gas) - [Custom errors should be used instead of require() statements to save gas](https://0xsimao.com/findings/metazero-ii-custom-require-statements-gas) - [completeUnstake() not following checks-effects-interactions pattern](https://0xsimao.com/findings/metazero-ii-complete-unstake-following-interactions) - [Constants should not be hardcoded](https://0xsimao.com/findings/metazero-ii-constants-hardcoded) - [Codebase is not using SafeERC20](https://0xsimao.com/findings/metazero-ii-codebase-safe-erc20) ## The report [Download the report (PDF)](https://0xsimao.com/reports/2024-04-06-metazero-ii.pdf)