balance

CertiK18 Dec 2024Files named in the report

Audit

CertiK reviewed Balance.Fun (balance) on 18 Dec 2024: 18 findings, 0 critical; 4 marked fixed, 2 acknowledged, 12 open.

No open critical findings

Open the report Open Balance.Fun’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings18

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	2	1
Medium	0	0	0
Low	12	0	3

HighMissing Update on `userPopupAmount`Fixed

The `topup` function in `TopUpV1` is designed to enable users to send tokens to a recipient address while keeping a record in `userPopupAmount`. However, the following statement only performs the calculation without updating the `userPopupAmount` mapping: ```solidity=104 userPopupAmount[msg.sender][erc20_topup_token].add(topup_amount); ```

LowInherited Contracts Not Initialized In InitializeFixed

Contract `TopUpV1` extends `ReentrancyGuardUpgradeable`, but the extended contract is not initialized by the current contract. Generally, the initializer function of a contract should always call all the initializer functions of the contracts that it extends.

LowInvalid Whitelist Token ValidationFixed

The `topup` function intends to validate user payments to ensure they involve a whitelisted token. However, the current `has_coin` check only verifies if the token appears in the `white_tokens` mapping and does not confirm whether the token is still valid. As a result, a token that has been marked as invalid might still be treated as valid.

LowRedundant Code ComponentsFixed

The linked statements do not affect the functionality of the codebase and appear to be either leftovers from test code or older functionality. - `onlyAdmin`