BNB Chain - BNB (refreshed)

CertiK1 address on Ethereum

CertiK reviewed BNB Chain (BNB Chain - BNB (refreshed)) on 3 Feb 2023: 10 findings, 0 critical; 1 acknowledged, 9 open.

No open critical findings
Open the reportOpen BNB Chain’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings10

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High010
Medium000
Low900
LowDeprecated standardsOpen

Usage of `throw` should be replaced with `revert()`.

LowFunction And Variable Naming Doesn't Match The OpOpen

The `BNB` contract has some references to `ETH` instead of `BNB` even though it is deployed on the Binance Smart Chain (BSC)

LowMissing Emit EventsOpen

Functions that update state variables should emit relevant events as notifications.

LowRedundant Code ComponentsOpen

The linked statements do not affect the functionality of the codebase and appear to be either leftovers from test code or older functionality.

LowShadowing Built-in SymbolOpen

A user-defined component is shadowing a built-in symbol. ```solidity=31 function assert(bool assertion) internal { ``` - Function `assert` is shadowing a built-in symbol.

LowSolidity Version Not RecommendedOpen

Solidity frequently releases new compiler versions. Using an old version prevents access to new Solidity security features. We also recommend avoiding complex `pragma` statements. The pragma statement in use allows old versions and it is not locked: ```solidity=1 pragma solidity ^0.4.8; ```

LowUnused Return VariableOpen

```solidity=89 returns (bool success) { ``` - The function `approve` implicitly returns and never writes the return variable `success`. --- ```solidity=97 function transferFrom(address _from, address _to, uint256 _value) returns (bool success) { ``` - The function `transferFrom` implicitly returns and never writes the return variable `success`. --- ```solidity=110 function burn(uint256 _value) returns (bool success) { ``` - The function `burn` implicitly returns and never writes the return variable `success`. --- ```solidity=119 function freeze(uint256 _value) returns (bool success) { ``` - The function `freeze` implicitly returns and never writes the return variable `success`. --- ```solidity=128 function unfreeze(uint256 _value) returns (bool success) { ``` - The function `unfreeze` implicitly returns and never writes the return variable `success`.

LowUsage of `transfer()` for Sending ETHOpen

It is not recommended to use Solidity's `transfer()` and `send()` functions for transferring ETH, since some contracts may not be able to receive the funds. Those functions forward only a fixed amount of gas (2300 specifically) and the receiving contracts may run out of gas before finishing the transfer. Also, EVM instructions' gas costs may increase in the future. Thus, some contracts that can receive now may stop working in the future due to the gas limitation. ```solidity=140 owner.transfer(amount); ``` - `withdrawEther()` uses `transfer()`.

LowVariables That Could Be Declared as ImmutableOpen

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.

Contracts in scope1

AddressChainSource code
0xb8c77482e45f1f44de1745f52c74426c631bdd52Chain: EthereumSource code: Verified source

Part of BNB Chain’s security record

BNB Chain
Audits2 audits by 1 firmLast audit Feb 2023, by CertiK.
Critical findingsNo open critical findingsAcross 2 reports.
Open BNB Chain’s security record

Security firm

CertiK

1,045 projects reviewed · 1,376 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us