# PxN Ghost Contract Findings

**Published by:** [kitkitchai.eth](https://paragraph.com/@kitkitchai-eth/)
**Published on:** 2022-05-10
**URL:** https://paragraph.com/@kitkitchai-eth/pxn-ghost-contract-findings

## Content

Having some spare time, I am learning web3 and smart contract. I am learning how to do some contract audit. Today, I am going to do PxN project, which is quite popular recently. https://etherscan.deth.net/address/0x160c404b2b49cbc3240055ceaee026df1e8497a0 A. Basic Analysis When doing a contract audit, 5 areas should be considered. Reentrancy - Safemint or nft transfer must be the last step in the function function teamMint(), mintDutchAuction(), mintWL() all are the last steps in the function ✅ Ownership - Wrong permission put into public function of the contract The contract has already added Ownable interface. ✅ All of the set functions added onlyOwner modifier ✅ Withdraw functions added onlyOwner modifier ✅ Timestamp Dependency - Mint time is set from the block time 😅 This block.timestamp can be configured by minter and let them mint earlier DOS with Flow✅ Refund -→ becareful the token cant be accepted, the refund cannot be proceeded. In PxN Contract, there is no refund activity Contract Interact ✅ the condition is make sure no contract interaction B. Logical Analysis Dutch Auction: funtion mintDutchAuction(), can only mint 2 Condition: DA_ACTIVE must be true Must be signed from dasigner , no direct minting Must not > da supply Check the block time > starttime and endtime Allow to mint 2 max per address check the condition if pay enough WL mint: function mintWL(), can only mint 1 Condition DA auction must be finished first Must be signed from wlsigner, no direct minting Check if it is over 6000 Check if there is doubleMiniting Check the block time > starttime and end time check the condition if pay enough Dev Mint: function devMint() The remaining supply will be minted by Owner Team Mint: function teamMint() Allow team player to mint This is my analysis. The contract looks good to me. I hope this is helpful!

## Publication Information

- [kitkitchai.eth](https://paragraph.com/@kitkitchai-eth/): Publication homepage
- [All Posts](https://paragraph.com/@kitkitchai-eth/): More posts from this publication
- [RSS Feed](https://api.paragraph.com/blogs/rss/@kitkitchai-eth): Subscribe to updates