You are reading an excerpt from our free but shortened abridged report! While still packed with incredible research and data, for just $20/month you can upgrade to our FULL library of 50+ reports (including this one) and complete industry-leading analysis on the top crypto assets. 

Becoming a Premium member means enjoying all the perks of a Basic membership PLUS:

• Full-length CORE Reports: More technical, in-depth research, actionable insights, and potential market alpha for serious crypto users
• Early access to future CORE ratings: Being early is sometimes just as important as being right!
• Premium Member CORE+ Reports: Coverage on the top issues pertaining to crypto users like bridge security, layer two solutions, DeFi plays, and more
• CORE report Audio playback: Don’t want to read? No problem! Listen on the go.

Vulnerabilities

Like any other project, The Sandbox is subject to potential lapses in security and vulnerabilities due to its reliance on smart contracts to operate. There are also some notable concerns regarding centralization, smart contracts, adoption metrics, and its SAND tokenomics model.

Smart Contract Security Concerns

A list of prior Sandbox audits can be found here.

There are two vulnerabilities found in The Sandbox's smart contract repository on GitHub that are described by the reputable smart contract auditing company Certik.

The first vulnerability (CKP-01) involves three smart contracts that have an issue with the role _owner. In these contracts, the _owner role has authority over certain functions. This means that any compromise of the _owner account can allow the hacker to modify some parameters associated with the contracts, such as ERC721, ERC1155, maxStakeOverall, and even steal tokens from the staking contract.

To mitigate this risk, Certik suggested that the privileged accounts' private keys should be carefully managed to avoid any potential hacking risks. They recommend improving centralized privileges or roles in the protocol via a decentralized mechanism or smart-contract-based accounts with enhanced security practices, such as multisig wallets. The report also offers some suggestions for short-term, long-term, and permanent resolutions.

The Sandbox has taken steps to mitigate this potential concern, but as 2023, it's still a technical avenue of exploitation by anyone with access to the account’s private keys.

The second vulnerability (CKP-02) involves the manipulation of users' contributions and rewards using flash loans. When the contribution rules contract is defined, users can manipulate their contributions to receive more rewards through a flash loan. This vulnerability can be mitigated by reviewing the feature’s design  to limit any case of abuse, disallowing this bonus feature if the user is a contract, limiting the maximum amount of bonus multiplier, and ensuring that staking users are not contracts.

The team behind The Sandbox has partially resolved the second vulnerability by setting a limit on the multiplier and adding more strict restrictions on contribution updates. The team also plans to introduce a DAO next year for all gaming aspects.

Both of these vulnerabilities are considered to be major faults in the code behind The Sandbox, per Certik. However, despite the issues, Certik gives Sandbox a favorable overall score (image below). Additionally, the project has also been audited by a second company, Solidified, and also runs a bug bounty through ImmuneFi, offering up to $200,000 in rewards.

Centralization and Tokenomics

Although The Sandbox is a decentralized platform, the nature of SAND’s tokenomics and the several private funding rounds to raise initial capital have resulted in a high degree of centralization. This is problematic because the token is responsible for conducting on-chain governance, thus dictating the future direction of the platform.

Businesses looking to establish a presence within The Sandbox need to be aware of this fact as the controlling entities overseeing governance (namely The Sandbox core developer team and early investors) have substantial influence over the socio-economic policies that The Sandbox may or may not choose to implement in the future.

Additionally, though not having a significant impact yet on the price of SAND, massive token unlocks (of which the majority of value is controlled by either The Sandbox directly or early investors) does present the possibility of massive price drawdown should early investors choose to cash out their now unlocked SAND tokens onto unsuspecting investors.

Technical Limitations

The single largest problem that The Sandbox faces has to do with technical limitations that could hinder the platform’s overall adoption and scalability. For one, blockchain gaming as a concept is inherently limited due to the limitations of blockchain computation itself. Blockchain was simply not invented to handle the massive load of graphical computation that’s often associated with massive multiplayer platforms. Of course, to combat this issue, The Sandbox has taken strides to limit graphical capabilities on the platform. This still places platforms, such as The Sandbox, at a distinct disadvantage versus off-chain competitors, such as Meta and Roblox.

Additionally, interoperability is another subject of debate for blockchain-based metaverse platforms. Right now, it's often difficult for brands to establish different presences in multiple blockchain metaverse platforms. This also fractures the overall user base of the Open Metaverse as a player establishing an avatar and acquiring assets in one platform may not be likely to do it in multiple platforms. Finding a technical solution to improve this interoperability gap would benefit all platforms within the Open Metaverse, The Sandbox included.

The biggest technical challenge for The Sandbox is within metaverse experience development. In Q3 2023, it's a slow, manual process that often requires specialized skills to develop virtual land into a playable, monetizable experience. Not to mention, this process is expensive, requiring upwards of thousands of dollars to design, build, and activate a metaverse experience in The Sandbox. This creates a major roadblock in The Sandbox’s ambitions for attracting a large user base and scaling its available player experiences. Novel market solutions have begun to emerge, such as Matera Protocol, that may provide an automated, on-chain solution to this problem. However, for now, the process remains slow, expensive, and convoluted.