Bridge Oracle

CertiK13 Sep 2022Files named in the report

Audit

CertiK reviewed Bridge (Bridge Oracle) on 13 Sep 2022: 9 findings, 0 critical; 6 marked fixed, 3 open.

No open critical findings

Open the report Open Bridge’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings9

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	0	4
Medium	0	1
Low	3	1

HighCentralization Related RisksFixed

In the contract `[Ownable]`, the role `[owner]` has authority over the following functions: - transferOwnership() - renounceOwnership() Any compromise to the `[owner]` account may allow a hacker to take advantage of this authority and become a malicious owner to potentially steal funds. In the contract `[Pauseable]`, the role `[owner]` has authority over the following functions: - halt() - start() Any compromise to the `[owner]` account may allow a hacker to take advantage of this authority and make the contract malfunction.

HighInitial Token DistributionFixed

All of the [BridgeToken] tokens are sent to the contract deployer when deploying the contract. This could be a centralization risk as the deployer can distribute [BridgeToken] tokens without obtaining the consensus of the community.

HighPrivileged functions allow owner to mint unlimiteFixed

In the contract `[StandardToken]`, the role `[owner]` has authority over the following functions: - mint() - burn() Any compromise to the `[owner]` account may allow a hacker to take advantage of this authority and mint unlimited tokens to arbitrary accounts and burn owner's tokens.

HighPrivileged functions allow owner to withdraw tokeFixed

In the contract `[BridgeToken]`, the role `[owner]` has authority over the following functions: - freeze() - melt() - transferAnyBEP20() - withdrawBNB() Any compromise to the `[owner]` account may allow a hacker to take advantage of this authority and steal ERC20 tokens and BNB from the contract.

MediumFrozen amount not handled properly in `burn()`Fixed

It is possible that after `burn()` is called, the message sender's frozen amount > balance, which will result in the token transfer from the message sender always fails.

LowInaccurate function name `freeze()` and `_freeze(Fixed

The functions `freeze()/_freeze()` transfer and freeze funds. The function names do not reflect the `transfer` action.