Ice - Audit 1

CertiK10 Jan 2024Files named in the report

CertiK reviewed Ice Open Network (Ice - Audit 1) on 10 Jan 2024: 17 findings, 0 critical; 15 marked fixed, 2 acknowledged.

No open critical findings

Open the report Open Ice Open Network’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings17

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	0	0
High	2	4
Medium	0	1
Low	0	10

HighCentralization Risks in ICEToken.solAcknowledged

In the contract `ICEToken` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority, change the configuration, and transfer assets. ![](https://accelerator-tasks-prod.acc.corp.certik.com/11ee-9445-3c989170-80dc-e521986210dc/diagrams/centralization_ICEToken-ICEToken-_owner.svg) ### Updates In the updated version [acb5dbb00eab45c41126279c7997acf33a5af0e1](https://github.com/ice-blockchain/erc-20-ice-coins-distribution/tree/acb5dbb00eab45c41126279c7997acf33a5af0e1), the changes regarding Centralization Risk are listed below: #### _owner - disableTrading(): removed. - setAirDropper(): newly added, manage the `_airDropper` role. - setSlippage(): newly added, set slippage. - renounceOwnership(): newly added, renounce the ownership of `_owner` and `_airDropper` role. - airdropToWallets(): removed. - setSwapBackThreshold(): newly added, manage the `_swapBackThreshold`. - setOperationsAddress(): removed. - setUniswapRouter(): newly added, mark an address as a known Uniswap router. - setKnownUniswapRouters(): newly added, mark all known Uniswap router addresses. #### _airDropper This role is newly introduced to manage the airdrop. - airdropToWallets(): manage the airdrop. --- In the updated version [c05e5ca785a5d4e2c36eb7bb74f881be952f243a](https://github.com/ice-blockchain/erc-20-ice-coins-distribution/tree/c05e5ca785a5d4e2c36eb7bb74f881be952f243a/contracts), the changes regarding Centralization Risk are listed below: #### _owner - setSlippage(): removed. - excludeFromFees(): removed. - excludeFromLimits(): newly added, set limit addresses. - setSwapBackThreshold(): removed. - forceSwapBack(): removed. - setUniswapV2LiquidityPool(): removed. - setKnownUniswapRouters(): renamed to `setKnownBNBUniswapRouters()`.

HighCentralized Balance ManipulationAcknowledged

In the contract `ICEToken`, the role `_owner` has the authority to update the token balance of an arbitrary account without sanity restriction. Any compromise to the `_owner` account may allow a hacker to take advantage of this authority and manipulate users' balances. For example, The hacker could also update his/her balance to a large number, sell these tokens, and cause the token price to drop. ### Updates In the updated version [acb5dbb00eab45c41126279c7997acf33a5af0e1](https://github.com/ice-blockchain/erc-20-ice-coins-distribution/tree/acb5dbb00eab45c41126279c7997acf33a5af0e1), The role `_airDropper` is newly introduced to replace the role `_owner` to have the authority to manage the `airdropToWallets()`.