CertiK reviewed Dora Factory (Dora Grant DAO V4) on 6 Mar 2023: 11 findings, 0 critical; 4 marked fixed, 1 acknowledged, 6 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 6 | 0 | 4 |
In the contract `DoraChecker` the role `_owner` has authority over the functions: * setWhitelist() * freeze() * unFreeze() * slash() Any compromise to the `_owner` or access to the functions may allow a hacker to do the following: - put account to white list. The hacker could add his account to the white list which could allow him to get the slashed funds. - free or unfreeze user staking account. The hacker could use this authority to freeze user staking account and slash him. Or unfreeze bad accounts to let them get funds. - slash specific user staking account. The hacker could use this authority to slash some accounts and get their funds. --- In the contract `DoraChecker` the users on the `whitelist` have authority over the functions: * slashTo() Any compromise to the `whitelist` or access to the functions may allow a hacker to do the following: - get slashed funds. The hacker could use this authority to transfer slashed funds to any account. --- In the contract `StakingEntry` the role `_owner` has authority over the functions: * setAdmin() * addSigningKeys() Any compromise to the `_owner` or access to the functions may allow a hacker to do the following: - add signature information. The hacker could use this authority to forbidden specific accounts to use deposit function.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (3)
1,044 projects reviewed · 1,393 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us