Matic

CertiKFiles named in the report

Audit

CertiK reviewed Polygon (Matic) on 19 Apr 2021: 15 findings, 1 critical; 14 marked fixed, 1 open.

1 critical finding, fixed
Open the reportOpen Polygon’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings15

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical001
High001
Medium000
Low1012
LowInefficient comparisonOpen

In function `numItems()` by the definition of `RLPItem` it is clear the the value of `currPtr` can never exceed `endPtr` and the while loop on line 234 would stop when `currPtr` and `endPtr` are equal, hence instead of `currPtr < endPtr` we can use `CurrPtr != endPtr` as each not equal comparison costs 3 less gas (negligible for short `RLPItem`, this exhibit is just here for completeness) than less than comparison

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (46)

  • contracts/child/ChildToken/ChildERC20.sol
  • contracts/child/ChildChainManager/ChildChainManager.sol
  • contracts/root/TokenPredicates/ITokenPredicate.sol
  • contracts/Migrations.sol
  • contracts/root/TokenPredicates/EtherPredicate.sol
  • contracts/root/RootToken/DummyERC721.sol
  • contracts/common/ContextMixin.sol
  • contracts/common/AccessControlMixin.sol
  • contracts/root/TokenPredicates/ERC721PredicateProxy.sol
  • contracts/root/TokenPredicates/ERC721Predicate.sol
  • contracts/root/TokenPredicates/ERC20Predicate.sol
  • contracts/root/RootToken/DummyMintableERC721.sol
  • contracts/root/MockCheckpointManager.sol
  • contracts/root/RootChainManager/RootChainManager.sol
  • contracts/common/Proxy/UpgradableProxy.sol
  • contracts/child/ChildToken/ChildERC1155.sol
  • contracts/common/NetworkAgnostic.sol
  • contracts/common/Initializable.sol
  • contracts/child/ChildToken/MaticWETH.sol
  • contracts/root/TokenPredicates/MintableERC721PredicateProxy.sol
  • contracts/root/StateSender/DummyStateSender.sol
  • contracts/test/ProxyTestImplStorageLayoutChange.sol
  • contracts/common/Proxy/Proxy.sol
  • contracts/lib/RLPReader.sol
  • contracts/child/ChildChainManager/ChildChainManagerProxy.sol
  • contracts/common/Proxy/IERCProxy.sol
  • contracts/root/StateSender/IStateSender.sol
  • contracts/root/TokenPredicates/MintableERC721Predicate.sol
  • contracts/child/ChildToken/ChildMintableERC721.sol
  • contracts/root/RootToken/DummyERC20.sol
  • contracts/child/ChildChainManager/IChildChainManager.sol
  • contracts/lib/Merkle.sol
  • contracts/root/TokenPredicates/EtherPredicateProxy.sol
  • contracts/root/RootToken/DummyERC1155.sol
  • contracts/lib/MerklePatriciaProof.sol
  • contracts/child/ChildToken/ChildERC721.sol
  • contracts/root/TokenPredicates/ERC1155Predicate.sol
  • contracts/root/RootToken/IMintableERC721.sol
  • contracts/test/ProxyTestImpl.sol
  • contracts/root/RootChainManager/IRootChainManager.sol
  • contracts/root/TokenPredicates/ERC1155PredicateProxy.sol
  • contracts/child/ChildToken/IChildToken.sol
  • contracts/root/TokenPredicates/ERC20PredicateProxy.sol
  • contracts/root/RootChainManager/RootChainManagerProxy.sol
  • contracts/common/EIP712Base.sol
  • contracts/root/ICheckpointManager.sol

Part of Polygon’s security record

Polygon
Audits12 audits by 6 firmsLast audit May 2025, by ChainSecurity.
Critical findingsNo open critical findingsAcross the 12 reports, 6 critical findings were reported. Each is marked fixed by the firm that reported it.
Open Polygon’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us