Chainport (Sol part)

CertiK26 Jan 2023Files named in the report

CertiK reviewed ChainPort Cross-Chain Bridge (Chainport (Sol part)) on 26 Jan 2023: 18 findings, 0 critical; 3 marked fixed, 5 acknowledged, 10 open.

No open critical findings

Open the report Open ChainPort Cross-Chain Bridge’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings18

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	5	0
Medium	2	0	1
Low	8	0	2

MediumPotential Fake Deposit EventFixed

The deposit and release functions only check if the token to be deposited is frozen. An attacker can call the deposit or release function with a malicious contract as input of the `token` parameter, emit an event "TokensDeposited(address(usdt), attacker, 1000 ether, 56)" in the `balanceOf()`/`safeTransfer()` function of the malicious contract. It is possible that this event will be accepted by the Chainport cross-chain system. If this happens, the attacker can withdraw tokens without depositing any token and drain the pool.

LowInefficient Conditional StatementFixed

Comparison `taxPercent >= 0` that is always true may be unnecessary. ```solidity=311 require(taxPercent >= 0 && taxPercent <= precision, "Tax override value"); ```

LowMissing Input ValidationFixed

The given input is missing the check to ensure the `originNetworkId` is not the `officialNetworkId`.