M20

CertiK17 Oct 2023Files named in the report

Audit

CertiK reviewed M20 on 17 Oct 2023: 19 findings, 0 critical; 12 marked fixed, 7 open.

No open critical findings

Open the report Open M20’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings19

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	0	5
Medium	0	2
Low	7	5

LowMap Iteration Be A Possible Source Of Non-determiOpen

Repository: - mcoin-evm Commit hash: - [`557f8d07f7b84fb77002e4d39e7c701ebc1f9416`](https://github.com/metherdev/mcoin-evm/tree/557f8d07f7b84fb77002e4d39e7c701ebc1f9416) Files: - app/app.go - tests/e2e/upgrade/manager.go When iterating over a map, the order in which the elements are returned may not be deterministic. It means that it could not rely on the value returned which could introduce non-determinism which is a very critical issue if it is involved in the consensus process, resulting in consensus breaking. The codebase has been examined, and it appears that the files mentioned above utilize map iteration in a correct manner. However, it has been observed that the underlying function calls or methods do not directly affect the key process. As a result, the severity of any potential issues is considered informational, serving as a warning for awareness. Although the severity is low, it is still advisable to make some adjustments to these code sections if possible. This can help ensure code clarity, maintainability, and to avoid potential issues that may arise in the future.

LowMissing Balance Check Of The Vesting Account WhenOpen

Repository: - mcoin-evm Commit hash: - [`557f8d07f7b84fb77002e4d39e7c701ebc1f9416`](https://github.com/metherdev/mcoin-evm/tree/557f8d07f7b84fb77002e4d39e7c701ebc1f9416) Files: - app/ante/vesting.go The `VestingDelegationDecorator` is used to check the vested coins being delegated especially for the vesting account. However, lack the check of the account balance towards the unvested coins during period scan could lead to some outcome unexpectedly. Only the coins in the account balance could be taken as spendable rather than the amount vested already. In the commit, some references has been removed, and the code volatile currently, recommend to refactor this code at first before further actions.

LowNot Check if `DeveloperShares` is zeroOpen

Repository: - mcoin-evm Commit hash: - [`557f8d07f7b84fb77002e4d39e7c701ebc1f9416`](https://github.com/metherdev/mcoin-evm/tree/557f8d07f7b84fb77002e4d39e7c701ebc1f9416) Files: - x/revenue/keeper/evm_hooks.go The function `PostTxProcessing()` does not check if `params.DeveloperShares` is zero, if `params.DeveloperShares` is zero `PostTxProcessing()` can return directly without calculating the developer fee.

LowRedundant Statements In Claims GenesisOpen

Repository: - mcoin-evm Commit hash: - [`557f8d07f7b84fb77002e4d39e7c701ebc1f9416`](https://github.com/metherdev/mcoin-evm/tree/557f8d07f7b84fb77002e4d39e7c701ebc1f9416) Files: - x/claims/genesis.go `totalEscrowed` will be assigned 10000 at L35 directly, so the linked statements do not affect the functionality of the codebase and appear to be either remnants of test code or older functionality. ```go=15 func InitGenesis(ctx sdk.Context, k keeper.Keeper, data types.GenesisState) { totalEscrowed := sdk.ZeroInt() sumUnclaimed := sdk.ZeroInt() numActions := sdk.NewInt(4) // ensure claim module account is set on genesis if acc := k.GetModuleAccount(ctx); acc == nil { panic("the claim module account has not been set") } // set the start time to the current block time by default if data.Params.AirdropStartTime.IsZero() { data.Params.AirdropStartTime = ctx.BlockTime() } k.SetParams(ctx, data.Params) escrowedCoins := k.GetModuleAccountBalances(ctx) if escrowedCoins != nil { totalEscrowed = escrowedCoins.AmountOfNoDenomValidation(data.Params.ClaimsDenom) } totalEscrowed = sdk.NewInt(10000) //... }

LowTesting FailureOpen

Repository: - mcoin-evm Commit hash: - [`557f8d07f7b84fb77002e4d39e7c701ebc1f9416`](https://github.com/metherdev/mcoin-evm/tree/557f8d07f7b84fb77002e4d39e7c701ebc1f9416) Files: - ./.../*test.go The test coverage for this project is relatively low and a large number of test cases run failed, which may bring unexpected errors in mainnet network.

LowTypedEvents Not Safe Due To An Unforeseen Bug InOpen

Repository: - mcoin-evm Commit hash: - [`557f8d07f7b84fb77002e4d39e7c701ebc1f9416`](https://github.com/metherdev/mcoin-evm/tree/557f8d07f7b84fb77002e4d39e7c701ebc1f9416) Files: - x/erc20/keeper/msg_server.go - x/erc20/proposal_handler.go - x/revenue/keeper/evm_hooks.go - x/revenue/keeper/msg_server.go - x/vesting/keeper/msg_server.go The `TypedEvents` implementation for event emitting is not so safe due to the bug in Ethermint RPCs, it is recommended to use the `EmitEvents` before further investigation.

LowUpdate Ledger Supported Algorithms to Consist ofOpen

Repository: - mcoin-evm Commit hash: - [`557f8d07f7b84fb77002e4d39e7c701ebc1f9416`](https://github.com/metherdev/mcoin-evm/tree/557f8d07f7b84fb77002e4d39e7c701ebc1f9416) Files: - crypto/keyring/options.go The `sdkhd.Secp256k1` is a built-in algorithm from Cosmos SDK. Since Ethermint's client module is used, Update SupportedAlgosLedger values to `hd.EthSecp256k1` can be more friendly and portable to Ethereum. References: - https://github.com/evmos/evmos/pull/1165/files