CertiK reviewed Galvan (Galvan DAO) on 14 Aug 2023: 2 findings, 0 critical; none marked fixed.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 1 | 0 | 0 |
In the project design, the owner is able to set the issuer of the protocol, which can call `mint()` to mint an arbitrary amount of tokens without any restriction. Any compromise to the owner or the issuer account may allow a hacker to take advantage of this authority, mint tokens, and sell tokens for profit, thus causing unexpected losses to the users/project. Additionally, related functions are listed below: - `mint()`: Issuer can mint an arbitrary amount of tokens to any address; - `setIssuer()`: Owner can set the issuer role; - `transferOwnership()`: Owner can set a new pending owner candidate; - `confirmOwnership()`: New pending owner candidate can confirm and become the new owner.
The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.
| Address | Chain | Source code |
|---|---|---|
| 0xf7e9…327b0xf7e945fce8f19302aacc7e1418b0a0bdef89327b | Chain: Ethereum | Source code: Verified source |
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us