Stargaze

CertiKFiles named in the report

CertiK reviewed Stargaze on 17 Apr 2023: 5 findings, 0 critical; all marked fixed.

No open critical findings
Open the reportOpen Stargaze’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings5

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium001
Low004
MediumCommands not addedFixed

The `ProposalUnsetPrivilegeContractCmd` and `ProposalSetPrivilegeContractCmd` commands are currently not properly integrated into the parent command, and as a result, they may not function correctly as tx commands.

LowA mismatched request structure is usedFixed

The type of `req` should be `UnsetPrivilegeProposalJSONReq`, the below code segment uses a mismatched request. ````go=28 func ProposalDemotePrivilegeContractHandler(cliCtx client.Context) govrest.ProposalRESTHandler { return govrest.ProposalRESTHandler{ SubRoute: "wasm_demote_privilege", Handler: func(w http.ResponseWriter, r *http.Request) { var req SetPrivilegeProposalJSONReq if !rest.ReadRESTReq(w, r, cliCtx.LegacyAmino, &req) { return } toStdTxResponse(cliCtx, w, req) }, } } ````

LowFailure on Tx cmdFixed

The [`readme`](https://github.com/public-awesome/stargaze/tree/b31a13e81a927d11449d2e9a176cd9d5a914039d/x/cron#how-to-use-in-cw-contract) for the current module provides some helpful `tx` command examples, but it has been found that some of them may not function as expected. For instance, the `promote-contract` command example is shown below: ````cmd starsd tx cron promote-contract {contractAddr} --title {proposalTitle} --deposit {depositAmount} starsd tx cron promote-contract stars19jq6mj84cnt9p7sagjxqf8hxtczwc8wlpuwe4sh62w45aheseues57n420 --title "Promote Contract Proposal" --deposit 1000ustars ```` When executing this command directly, it generates an error message indicating an invalid address. Upon further investigation, it has been determined that this error is due to the lack of a proposer, i.e., it cannot obtain the `from` address of the `clientCtx`. Additionally, the `from` flag for this command is not recognized.

LowIncorrect Key UsedFixed

In Cosmos, the `telemetry.ModuleMeasureSince` function is used to measure the elapsed time since a specific event occurred in a module. When using this function in the `BeginBlocker()` function of a Cosmos SDK module, it is important to use the correct metric key for the event being measured. ````go func BeginBlocker(ctx sdk.Context, k keeper.Keeper, w types.WasmKeeper) { defer telemetry.ModuleMeasureSince(types.ModuleName, time.Now(), telemetry.MetricKeyEndBlocker) sudoMsg := contract.SudoMsg{BeginBlock: &struct{}{}} k.IteratePrivileged(ctx, abciContractCallback(ctx, w, sudoMsg)) } ```` The correct metric key for measuring the elapsed time of the `BeginBlocker()` function is `telemetry.MetricKeyBeginBlocker`.

LowOptimization on function `SetPrivileged()`Fixed

The `SetPrivileged()` function is used to add a contract to the list of privileged contracts or update it if it is already in the list. However, if the contract is already privileged, there is no need to update the store and this can be an unnecessary gas cost.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (21)

  • x/cron/abci.go
  • x/cron/contract/callback_msgs.go
  • x/cron/types/keys.go
  • x/cron/types/events.go
  • x/cron/keeper/keeper.go
  • x/cron/types/params.go
  • x/cron/client/rest/tx.go
  • x/cron/module.go
  • x/cron/client/cli/query.go
  • x/cron/keeper/grpc_query.go
  • x/cron/types/expected_keepers.go
  • x/cron/types/genesis.go
  • x/cron/keeper/privileged.go
  • x/cron/types/types.go
  • x/cron/client/cli/tx.go
  • x/cron/types/proposal.go
  • x/cron/types/errors.go
  • x/cron/genesis.go
  • x/cron/keeper/msg_server.go
  • x/cron/client/proposal_handler.go
  • x/cron/types/codec.go

Part of Stargaze’s security record

Stargaze
Audits4 audits by 2 firmsLast audit Jul 2023, by Oak Security.
Critical findings1 critical acknowledged, not fixedReported in “Stargaze Infinity Pool audit” by Oak Security, Jul 2023. The team acknowledged it.
Open Stargaze’s security record

Security firm

CertiK

1,044 projects reviewed · 1,393 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us