# PxN Ghost Contract Findings

By [kitkitchai.eth](https://paragraph.com/@kitkitchai-eth) · 2022-05-10

---

Having some spare time, I am learning web3 and smart contract. I am learning how to do some contract audit. Today, I am going to do PxN project, which is quite popular recently.

[https://etherscan.deth.net/address/0x160c404b2b49cbc3240055ceaee026df1e8497a0](https://etherscan.deth.net/address/0x160c404b2b49cbc3240055ceaee026df1e8497a0)

A. Basic Analysis
-----------------

When doing a contract audit, 5 areas should be considered.

*   **Reentrancy -** Safemint or nft transfer must be the last step in the function
    
    function teamMint(), mintDutchAuction(), mintWL() all are the last steps in the function **✅**
    
*   **Ownership** - Wrong permission put into public function of the contract
    
    The contract has already added Ownable interface. **✅**
    

![](https://storage.googleapis.com/papyrus_images/f90998c13ed4c754534f4dc08cef3525e91ddc6c7050f3226443795f83bae543.png)

All of the set functions added **onlyOwner modifier ✅**

Withdraw functions added **onlyOwner modifier ✅**

*   **Timestamp Dependency** - Mint time is set from the block time 😅
    

![This block.timestamp can be configured by minter and let them mint earlier](https://storage.googleapis.com/papyrus_images/d9482a2b1026103a1caf9ca99430448a07182df76b2c2ca1b08f2f8b2ec0fbd7.png)

This block.timestamp can be configured by minter and let them mint earlier

*   **DOS with Flow✅**
    
    Refund -→ becareful the token cant be accepted, the refund cannot be proceeded.
    
    In PxN Contract, there is no refund activity
    
*   **Contract Interact ✅**
    

![the condition is make sure no contract interaction](https://storage.googleapis.com/papyrus_images/a88ec28e15790a398827c9ce8055388739dd0a4ab1f874dbd632679838628d7e.png)

the condition is make sure no contract interaction

B. Logical Analysis
-------------------

**Dutch Auction: funtion mintDutchAuction(), can only mint 2**

Condition:

1.  DA\_ACTIVE must be true
    
2.  Must be signed from dasigner , no direct minting
    
3.  Must not > da supply
    
4.  Check the block time > starttime and endtime
    
5.  Allow to mint 2 max per address
    
6.  check the condition if pay enough
    

**WL mint: function mintWL(), can only mint 1**

Condition

1.  DA auction must be finished first
    
2.  Must be signed from wlsigner, no direct minting
    
3.  Check if it is over 6000
    
4.  Check if there is doubleMiniting
    
5.  Check the block time > starttime and end time
    
6.  check the condition if pay enough
    

**Dev Mint: function devMint()**

The remaining supply will be minted by Owner

**Team Mint: function teamMint()**

Allow team player to mint

This is my analysis. The contract looks good to me. I hope this is helpful!

---

*Originally published on [kitkitchai.eth](https://paragraph.com/@kitkitchai-eth/pxn-ghost-contract-findings)*