CertiK reviewed Mazimatic (Mazimatic - New Audit) on 27 Mar 2023: 20 findings, 0 critical; 16 marked fixed, 4 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 2 |
| Low | 4 | 0 | 14 |
The function `setAntisnipeDisable()` is set in a way that the flag `antisnipeDisable` (that has a default value of false) can only be set as `true` once by the owner. ```solidity function setAntisnipeDisable() external onlyOwner { require(!antisnipeDisable); antisnipeDisable = true; } ``` The audit team would like to check if this is intended and whether there should be a method to toggle between turning on and off the `antisnipeDisable` flag.
The audit team would like to better understand how the `liquidityTimestamp` is used. In the following codeblock, it is used to determine the eventual value of `amount2` in function `_transfer()`. ```solidity=138 if (to == pairAddress && liquidityTimestamp != 0) { if (block.timestamp < liquidityTimestamp + 24 hours) { return (amount * 1000) / 10000; } else if ( liquidityTimestamp + 24 hours < block.timestamp && block.timestamp < liquidityTimestamp + 48 hours ) { return (amount * 500) / 10000; } return 0; ``` Once the `liquidityTimestamp` has passed, the value of `amount2` will always be 0, therefore the value of `liquidityTimestamp` must be reset to another value to re-enable the other conditions. The audit team would like to check if this aligns with the intended design.
The logic currently only manages one `pairAddress()` which is the one that is created in the `initialize()` function of the contract. If other users create new uniswap pair addresses, the amount handling in the `_botManager()` will be bypassed. The audit team would like to know if this implementation matches the intended design.
The MaziToken implemented a cool down mechanism, meaning that two consecutive token transfers within certain time interval may cause the second transfer to revert. For example, if the token is used in a vault contract, the withdraw function may need to invoke the two transfers (the first time to transfer fees and the second time to transfer tokens to users), which may lead to a potential revert of the function and prevent withdrawals. Therefore, the token may be not compatible with many protocols.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (1)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us