CertiK reviewed Noah on 5 Jul 2023: 6 findings, 0 critical; 1 marked fixed, 1 acknowledged, 4 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 4 | 0 | 1 |
Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=18 admin = _admin; ``` - `_admin` is not zero-checked before being used. --- ```solidity=47 feeTo = _feeTo; ``` - `_feeTo` is not zero-checked before being used. --- ```solidity=52 admin = _admin; ``` - `_admin` is not zero-checked before being used. --- ```solidity=73 token0 = _token0; ``` - `_token0` is not zero-checked before being used. --- ```solidity=74 token1 = _token1; ``` - `_token1` is not zero-checked before being used. --- ```solidity=25 factory = _factory; ``` - `_factory` is not zero-checked before being used. --- ```solidity=26 WETH = _WETH; ``` - `_WETH` is not zero-checked before being used.
The return value of the transfer()/transferFrom() call is not checked. ```solidity=137 INoahPair(pair).transferFrom(msg.sender, pair, liquidity); // send liquidity to pair ```
The return value of an external call is not stored in a local or state variable. ```solidity=44 INoahFactory(factory).createPair(tokenA, tokenB); ```
```solidity=19 address public factory; ``` The above variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (8)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us