NOAH

CertiK5 Jul 2023Files named in the report

Audit

CertiK reviewed Noah on 5 Jul 2023: 6 findings, 0 critical; 1 marked fixed, 1 acknowledged, 4 open.

No open critical findings

Open the report Open Noah’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings6

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	1	0
Medium	0	0	0
Low	4	0	1

HighCentralization Related RisksAcknowledged

In the contract `NoahFactory` the role `admin` has authority over the functions shown in the diagram below. ![](https://accelerator-tasks-prod.acc.corp.certik.com/e5aed7aefb17468089a708bec3d7d422/diagrams/centralization_NoahFactory-NoahFactory-admin.svg) - `setFeeTo(address _feeTo)`: Sets the fee recipient address, can only be called by the admin. - `setAdmin(address _admin)`: Sets a new admin address, can only be called by the current admin. - `setFeeRate(address pair, uint256 _feeRate)`: Sets the fee rate for a specific pair, can only be called by the admin. - `toggleState()`: Toggles the state of the contract between Active and Pending, can only be called by the admin. Once the status is toggled to Pending by the amdin, the functions mint/burn/swap in the NoahPair contract will be paused. --- In the contract `NoahPair` the role `factory` has authority over the functions shown in the diagram below. ![](https://accelerator-tasks-prod.acc.corp.certik.com/e5aed7aefb17468089a708bec3d7d422/diagrams/centralization_NoahPair-NoahPair-factory.svg) - `initialize(address _token0, address _token1)`: Initializes the pair's token0 and token1 addresses, only callable by the factory contract. Any compromise to the privileged account may allow the hacker to take advantage of this authority.