CertiK reviewed Icplaza on 13 Sep 2022: 6 findings, 0 critical; 5 marked fixed, 1 acknowledged.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 1 | 4 |
```go=41 fee := authBiz.Price count := authBiz.Amount.Amount.Quo(authBiz.Price.Amount) if count.LT(sdk.OneInt()) { return rc } if count.Equal(sdk.OneInt()) { fee = authBiz.Amount } ``` Since the result of the `Quo()` method yields the floor value of the division result, the `if` statement on line 47 is not necessary. This may cause the actual fee to be greater than the due amount.
```go=95 func (k Keeper) WithdrawAuthorization(ctx sdk.Context, granteeAddr, authorizerAddr sdk.AccAddress, bizName string) (sdk.Coin, error) { return sdk.NewInt64Coin(sdk.DefaultBondDenom, 0), sdkerrors.Wrap(sdkerrors.ErrNotSupported, "Withdrawing authorization do not implement") } ``` The function `withdrawAuthorization()` just returns an error. We have the following speculations about it. 1. The business logic does not allow the user to withdraw authorization. However, the `withdrawAuthorization()` function should be implemented here for other reasons. 2. This function is incomplete.
```go=83 if err := k.bankKeeper.SendCoinsFromAccountToModule(ctx, granteeAddr, types.ModuleName, sdk.NewCoins(fee)); err != nil { return err } ``` Consider that the grantee will transfer some coins to a module address in the `ReqAuthorization()` method. Is this operation used to buy something? For example, a module-issued coin, a community governance voucher, or something else. ```go func (k Keeper) consumeAuthorization(ctx sdk.Context, authBiz *types.AcqBiz) (bool) { rc := false fee := authBiz.Price ...... authBiz.Amount = authBiz.Amount.Sub(fee) ...... if err = k.bankKeeper.SendCoinsFromModuleToAccount(ctx, types.ModuleName, authorizerAddr, sdk.NewCoins(fee)); err != nil { return rc } ``` Also, in the `consumeAuthorization()` method, the coins from `authBiz` will be split into two parts, one part will be used to purchase the authorizer as `fees` and the other part will stay in `authBiz`. Then what happens to the remaining `authBiz.Amount` coins? Will they be returned to the grantee, or will they stay for the next use? We may have a different understanding of this project, and we hope to bridge this gap so that our understanding is correct.
The codes in linked positions are never used.
The returned `error` is unhandled in linked positions.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (20)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us