Hashflow-Audit3

CertiK19 Sep 2022Files named in the report

CertiK reviewed Hashflow (Hashflow-Audit3) on 19 Sep 2022: 9 findings, 0 critical; 6 marked fixed, 1 acknowledged, 2 open.

No open critical findings

Open the report Open Hashflow’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings9

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	1	0
Medium	0	0	0
Low	2	0	6

LowInconsistency Between Comment and CodeFixed

There is an inconsistency between code and comment on L654. The comments for multi-hop trades is incorrectly placed in the single-hop trade code block.

LowInefficient Conditional StatementFixed

Comparison `percentWithdrawLimit >= 0`, that is always true, may be unnecessary. ```solidity=119 require( percentWithdrawLimit >= 0 && percentWithdrawLimit <= 100, 'HashflowGovernance: Number should be a percentage.' ); ```

LowLack of Storage Gap in Upgradeable ContractFixed

For upgradeable contracts, there must be a storage gap to "allow developers to freely add new state variables in the future without compromising the storage compatibility with existing deployments". Otherwise, it may be very difficult to write new implementation code. Without storage gap, the variable in the child contract might be overwritten by the upgraded base contract if new variables are added to the base contract. Refer to https://docs.openzeppelin.com/upgrades-plugins/1.x/writing-upgradeable

LowMissing Pool Authority Check in RFQt Cross ChainFixed

In contract `HashflowRouter`, function `tradeXChain()` proceeds without using `_isPoolAuthorized()` function to confirm if the quote.pool is allowed, whereas this check is carried out in RFQm process.

LowTypos in Comments and Error MessagesFixed

Several typos were found in the comments of different files.

LowUser-Defined GettersFixed

The linked functions are equivalent to the compiler-generated getter functions for the respective variables.