ICPLAZA

CertiKFiles named in the report

CertiK reviewed Icplaza on 13 Sep 2022: 6 findings, 0 critical; 5 marked fixed, 1 acknowledged.

No open critical findings
Open the reportOpen Icplaza’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings6

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium001
Low014
MediumPotential OverpaymentFixed

```go=41 fee := authBiz.Price count := authBiz.Amount.Amount.Quo(authBiz.Price.Amount) if count.LT(sdk.OneInt()) { return rc } if count.Equal(sdk.OneInt()) { fee = authBiz.Amount } ``` Since the result of the `Quo()` method yields the floor value of the division result, the `if` statement on line 47 is not necessary. This may cause the actual fee to be greater than the due amount.

LowCode May Be IncompleteFixed

```go=95 func (k Keeper) WithdrawAuthorization(ctx sdk.Context, granteeAddr, authorizerAddr sdk.AccAddress, bizName string) (sdk.Coin, error) { return sdk.NewInt64Coin(sdk.DefaultBondDenom, 0), sdkerrors.Wrap(sdkerrors.ErrNotSupported, "Withdrawing authorization do not implement") } ``` The function `withdrawAuthorization()` just returns an error. We have the following speculations about it. 1. The business logic does not allow the user to withdraw authorization. However, the `withdrawAuthorization()` function should be implemented here for other reasons. 2. This function is incomplete.

LowDiscussion on `authBiz.Amount` coinsFixed

```go=83 if err := k.bankKeeper.SendCoinsFromAccountToModule(ctx, granteeAddr, types.ModuleName, sdk.NewCoins(fee)); err != nil { return err } ``` Consider that the grantee will transfer some coins to a module address in the `ReqAuthorization()` method. Is this operation used to buy something? For example, a module-issued coin, a community governance voucher, or something else. ```go func (k Keeper) consumeAuthorization(ctx sdk.Context, authBiz *types.AcqBiz) (bool) { rc := false fee := authBiz.Price ...... authBiz.Amount = authBiz.Amount.Sub(fee) ...... if err = k.bankKeeper.SendCoinsFromModuleToAccount(ctx, types.ModuleName, authorizerAddr, sdk.NewCoins(fee)); err != nil { return rc } ``` Also, in the `consumeAuthorization()` method, the coins from `authBiz` will be split into two parts, one part will be used to purchase the authorizer as `fees` and the other part will stay in `authBiz`. Then what happens to the remaining `authBiz.Amount` coins? Will they be returned to the grantee, or will they stay for the next use? We may have a different understanding of this project, and we hope to bridge this gap so that our understanding is correct.

LowRedundant CodeFixed

The codes in linked positions are never used.

LowUnhandled Return ValueFixed

The returned `error` is unhandled in linked positions.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (20)

  • x/validator-dao/handler.go
  • x/validator-dao/keeper/hooks.go
  • x/validator-dao/keeper/params.go
  • x/validator-dao/types/expected_keepers.go
  • x/validator-dao/types/msgs.go
  • x/validator-dao/types/params.go
  • x/validator-dao/types/errors.go
  • x/validator-dao/types/dao.go
  • x/validator-dao/genesis.go
  • x/validator-dao/keeper/dao.go
  • x/validator-dao/keeper/msg_server.go
  • x/validator-dao/types/keys.go
  • x/validator-dao/types/genesis.go
  • x/validator-dao/keeper/keeper.go
  • x/validator-dao/client/cli/query.go
  • x/validator-dao/keeper/grpc_query.go
  • x/validator-dao/module.go
  • x/validator-dao/types/codec.go
  • x/validator-dao/client/cli/tx.go
  • x/validator-dao/types/events.go

Part of Icplaza’s security record

Icplaza
Audits2 audits by 1 firmLast audit Oct 2022, by CertiK.
Critical findingsNo open critical findingsAcross 2 reports.
Open Icplaza’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us