IcyBox (ICYBOX) security report
Radar AI scanned IcyBox on Ethereum. Material findings include unrestricted buyback-rate changes, potentially manipulable box randomness, and centralized parcel-desk controls.
IcyBox is not free of material contract risk. The primary concern is centralized buyback-rate control, which can materially alter redemption payouts and may expose reserves to unfavorable pricing if the operator sets an extreme rate. Box randomness is also not commit-reveal or otherwise manipulation-resistant. Slither was not run.
Trust score: 42/100. Source verified: Yes. Chain: ethereum. Contract: 0x92cb9b5d43abce8a662d27e65893c2b7a690f158.
This report was last modified on 2026-10-13 and contains 3 material findings.
high finding: Buyback operator can arbitrarily change redemption pricing
The buyback desk operator can set weiPerUsd to any nonzero value without a maximum, timelock, governance process, or oracle validation. Because quote() multiplies the listed item value by weiPerUsd and the holder tier rate, this authority can materially increase or decrease ETH redemption amounts. An operator setting an excessively high value could cause eligible redemptions to consume the desk balance until payments fail; a low value can materially reduce payouts.
Evidence: In IcyBuybackDesk.sol, setRate(uint256 w) only checks msg.sender == operator and w != 0, then assigns weiPerUsd = w. quote() computes usd * weiPerUsd * sellBackBps / 10000, and sellBack() pays that quote when the desk balance is sufficient. setOperator() also lets the current operator transfer this authority to another address.
Recommendation: Protect rate changes with bounded limits, a transparent governance or multisignature process, a timelock, and preferably a validated pricing mechanism. Emit and monitor rate changes, and define explicit reserve and payout safeguards before enabling redemptions.
medium finding: Box outcome randomness is potentially manipulable
Box results are derived from blockhash, block.prevrandao, msg.sender, an incrementing counter, and the contract address. This is not a commit-reveal scheme and does not use an external verifiable randomness source. A block producer may have some influence over block-derived inputs, while users may be able to choose transaction timing or submission conditions. The practical impact depends on the ability to influence inclusion and the value of particular outcomes.
Evidence: In IcyBoxOpener.open(), seed is computed as keccak256(abi.encodePacked(blockhash(block.number - 1), block.prevrandao, msg.sender, n, address(this))). The resulting seed determines roll, tier, category, and item kind. IcyDrawLedger exists separately but is not consulted by open().
Recommendation: Use a properly integrated commit-reveal design or a reputable verifiable randomness provider. Bind the finalized random result to a request identifier and ensure failed, delayed, or reordered transactions cannot give participants or block producers useful outcome-selection control.
medium finding: Shipping operator controls fees and can sweep collected funds
The parcel operator can change the shipping fee to any value and can sweep all accumulated shipping fees to an arbitrary nonzero address. This is an explicit custodial and operational control rather than an unprivileged exploit. Users may face unexpected fees, and collected shipping funds are not constrained to a fulfillment or refund mechanism by the contract.
Evidence: In IcyParcelDesk.sol, setFee(uint256 f) accepts any value when called by operator. sweep(address to) also accepts any nonzero destination and transfers the entire pot to it when called by operator. requestShip() charges the current fee and increments pot.
Recommendation: Put fee changes behind bounded parameters, multisignature approval, and a timelock. Restrict or transparently govern sweeps, add refund and fulfillment rules, and publish operator-change and fee-change monitoring.