CertiK reviewed BNB Chain (BNB Chain - BNB (refreshed)) on 3 Feb 2023: 10 findings, 0 critical; 1 acknowledged, 9 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 9 | 0 | 0 |
Usage of `throw` should be replaced with `revert()`.
The `BNB` contract has some references to `ETH` instead of `BNB` even though it is deployed on the Binance Smart Chain (BSC)
Functions that update state variables should emit relevant events as notifications.
The linked statements do not affect the functionality of the codebase and appear to be either leftovers from test code or older functionality.
A user-defined component is shadowing a built-in symbol. ```solidity=31 function assert(bool assertion) internal { ``` - Function `assert` is shadowing a built-in symbol.
Solidity frequently releases new compiler versions. Using an old version prevents access to new Solidity security features. We also recommend avoiding complex `pragma` statements. The pragma statement in use allows old versions and it is not locked: ```solidity=1 pragma solidity ^0.4.8; ```
```solidity=89 returns (bool success) { ``` - The function `approve` implicitly returns and never writes the return variable `success`. --- ```solidity=97 function transferFrom(address _from, address _to, uint256 _value) returns (bool success) { ``` - The function `transferFrom` implicitly returns and never writes the return variable `success`. --- ```solidity=110 function burn(uint256 _value) returns (bool success) { ``` - The function `burn` implicitly returns and never writes the return variable `success`. --- ```solidity=119 function freeze(uint256 _value) returns (bool success) { ``` - The function `freeze` implicitly returns and never writes the return variable `success`. --- ```solidity=128 function unfreeze(uint256 _value) returns (bool success) { ``` - The function `unfreeze` implicitly returns and never writes the return variable `success`.
It is not recommended to use Solidity's `transfer()` and `send()` functions for transferring ETH, since some contracts may not be able to receive the funds. Those functions forward only a fixed amount of gas (2300 specifically) and the receiving contracts may run out of gas before finishing the transfer. Also, EVM instructions' gas costs may increase in the future. Thus, some contracts that can receive now may stop working in the future due to the gas limitation. ```solidity=140 owner.transfer(amount); ``` - `withdrawEther()` uses `transfer()`.
The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.
| Address | Chain | Source code |
|---|---|---|
| 0xb8c7…dd520xb8c77482e45f1f44de1745f52c74426c631bdd52 | Chain: Ethereum | Source code: Verified source |
1,045 projects reviewed · 1,376 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us