anticsdecoded|Portfolio
SEC|2026
/audits / UTIX.sol
cat /audits/UTIX.sol
NODE: BOUNTY

Token crowdsale

// engagement
protocolUtix
categoryToken crowdsale
kindbounty · Immunefi
date2026-03
duration4 days
languageSolidity
chainsEthereum
nSLOC520
reportview report ↗
// findingsNODE: 1 FND
critical1
high0
medium0
low0
info0
gas0
// summary

Immunefi review of Utix's deployed MintedTokenCappedCrowdsaleExtv1 token crowdsale on Ethereum mainnet, which custodies raised ETH and pays it out to a configured multisig.

// methodology
  • Manual review
  • PoC development
  • Mainnet fork testing
// scope
pathnsloc
MintedTokenCappedCrowdsaleExtv1.sol520
total520
// findings
C-01criticalacknowledged

EOA-only withdrawal guard permanently locks 451 ETH

The crowdsale holds 451.32137 ETH but its withdrawal helper requires the payout `multisigWallet` to pass an `extcodesize == 0` EOA check while the configured wallet is a Gnosis Safe (non-zero code), so every withdrawal reverts; a second defect (`investorCount.plus(1)` result discarded) blocks `setMultisig`, together permanently freezing the full 451 ETH.