RXT Token NFT Contract
Co-audit conducted by Zealynx and Soken of the RXT Token NFT contract on Polygon, an OpenSea-style ERC-1155 asset contract with native meta-transaction support. The 12 findings (4 High, 2 Medium, 3 Low, 3 Informational) focus on meta-transaction security: gas griefing and replay risks in NativeMetaTransaction, reentrancy in executeMetaTransaction, ERC-165 supportsInterface gas accounting, and unbounded loops in batch operations. All findings reported as Open at the time of publication.
Scope
1 fileFindings
click any row for the full write-upKey Findings
- Insufficient gas griefing attack on
NativeMetaTransaction. TheexecuteMetaTransactionflow only increments the user nonce after the innerverify(...)and signature check, so a transaction that runs out of gas mid-execution leaves the nonce unchanged and allows the same signed payload to be replayed. - Reentrancy in
executeMetaTransactioncan lead to loss of funds. The function performsaddress(this).call(...)without a reentrancy guard, letting a malicious recipient re-enter the meta-transaction handler and manipulate nonce state or value transfers during the call. - Unbounded loops across
balanceOfBatch,safeBatchTransferFrom,_batchMint,_burnBatch,batchBurn, andbatchMint. Each iterates over an unrestricted input array, so a sufficiently long array exhausts the block gas limit and bricks the call, potentially locking assets and degrading user experience. - Owner is a single point of failure and a centralization risk. Sixteen privileged functions are gated by a single EOA owner with no timelock and no multisig requirement, so a compromised key can cause severe damage to the project.
supportsInterfaceis exposed to insufficient-gas misreporting. The ERC-165 helper relies on the caller supplying enough gas; under EIP-150's 1/64 rule the function can throw out-of-gas and silently return that an interface is unsupported when in fact it is, breaking downstream integrations.
Team & approval
Disclaimer
This audit is not an endorsement and does not constitute investment advice. Zealynx reviewed the codebase at the commits listed in section 02 over the engagement window. Findings are limited to issues identified within that scope and do not preclude the existence of other vulnerabilities. Subsequent code changes are not covered by this report unless the engagement is explicitly extended.
