Matchain Genesis License
Zealynx audited the Matchain Genesis License NFT and its companion NFT-staking contract for Immunefi. The 3-day review identified 14 issues including 1 Critical (reward dilution from a fixed denominator that ignores actual staked count), 1 High (front-running rewardDistribution() to capture rewards without time staked), and 1 Medium (mint replay protection missing a nonce). 4 issues were fixed and 10 were acknowledged.
Scope
2 filesFindings
click any row for the full write-upKey Findings
- Reward distribution uses a fixed denominator instead of actual staked count.
GenesisLicenseStakingdivides incoming rewards byNFT_AMOUNT_PER_STAKING_POOL = 20000, assuming all 20,000 NFTs are minted and staked. In practice only a fraction are staked at any time, so each staker receives a share diluted across an inflated, fixed denominator. rewardDistribution()is sandwich-attackable. Because pending rewards are computed as the delta ofstakingRewardPerGLrather than weighted by staking time, a watcher can stake right before a knownrewardDistribution()call and unstake immediately after, capturing the full reward without meaningful time staked.mint()signature replay protection lacks a nonce. The EIP-712 hash is composed only of(to, value, stakingPool). Repeated legitimate mints with identical parameters all hash the same and are rejected as replays after the first; recommend adding a per-address nonce to the signed struct.- EIP-712 mint signatures have no expiration. Once issued, a
mint()signature is valid indefinitely until used, so authorisations cannot be invalidated except by consuming them. Recommend adding adeadlineparameter to the signed struct. - No recovery mechanism for unclaimed rewards. Rewards inserted into the claim queue can sit indefinitely if the user never calls
claim(). There is no expiration window and no admin path to recover or redistribute the locked balance.
Team & approval
Disclaimer
This audit is not an endorsement and does not constitute investment advice. Zealynx reviewed the codebase at the commits listed in section 02 over the engagement window. Findings are limited to issues identified within that scope and do not preclude the existence of other vulnerabilities. Subsequent code changes are not covered by this report unless the engagement is explicitly extended.
