CertiK reviewed Stargaze on 17 Apr 2023: 5 findings, 0 critical; all marked fixed.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 0 | 4 |
The `ProposalUnsetPrivilegeContractCmd` and `ProposalSetPrivilegeContractCmd` commands are currently not properly integrated into the parent command, and as a result, they may not function correctly as tx commands.
The type of `req` should be `UnsetPrivilegeProposalJSONReq`, the below code segment uses a mismatched request. ````go=28 func ProposalDemotePrivilegeContractHandler(cliCtx client.Context) govrest.ProposalRESTHandler { return govrest.ProposalRESTHandler{ SubRoute: "wasm_demote_privilege", Handler: func(w http.ResponseWriter, r *http.Request) { var req SetPrivilegeProposalJSONReq if !rest.ReadRESTReq(w, r, cliCtx.LegacyAmino, &req) { return } toStdTxResponse(cliCtx, w, req) }, } } ````
The [`readme`](https://github.com/public-awesome/stargaze/tree/b31a13e81a927d11449d2e9a176cd9d5a914039d/x/cron#how-to-use-in-cw-contract) for the current module provides some helpful `tx` command examples, but it has been found that some of them may not function as expected. For instance, the `promote-contract` command example is shown below: ````cmd starsd tx cron promote-contract {contractAddr} --title {proposalTitle} --deposit {depositAmount} starsd tx cron promote-contract stars19jq6mj84cnt9p7sagjxqf8hxtczwc8wlpuwe4sh62w45aheseues57n420 --title "Promote Contract Proposal" --deposit 1000ustars ```` When executing this command directly, it generates an error message indicating an invalid address. Upon further investigation, it has been determined that this error is due to the lack of a proposer, i.e., it cannot obtain the `from` address of the `clientCtx`. Additionally, the `from` flag for this command is not recognized.
In Cosmos, the `telemetry.ModuleMeasureSince` function is used to measure the elapsed time since a specific event occurred in a module. When using this function in the `BeginBlocker()` function of a Cosmos SDK module, it is important to use the correct metric key for the event being measured. ````go func BeginBlocker(ctx sdk.Context, k keeper.Keeper, w types.WasmKeeper) { defer telemetry.ModuleMeasureSince(types.ModuleName, time.Now(), telemetry.MetricKeyEndBlocker) sudoMsg := contract.SudoMsg{BeginBlock: &struct{}{}} k.IteratePrivileged(ctx, abciContractCallback(ctx, w, sudoMsg)) } ```` The correct metric key for measuring the elapsed time of the `BeginBlocker()` function is `telemetry.MetricKeyBeginBlocker`.
The `SetPrivileged()` function is used to add a contract to the list of privileged contracts or update it if it is already in the list. However, if the contract is already privileged, there is no need to update the store and this can be an unnecessary gas cost.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (21)
1,044 projects reviewed · 1,393 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us