XCN Swap - Audit

CertiK18 Aug 2022Files named in the report

CertiK reviewed Onyx Protocol (XCN Swap - Audit) on 18 Aug 2022: 5 findings, 0 critical; 4 marked fixed, 1 open.

No open critical findings

Open the report Open Onyx Protocol’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings5

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	0	1
Medium	0	0
Low	1	3

HighCentralization Related RisksFixed

In the contract `Swap.sol`, the role `Owner` has authority over the following functions: - withdraw() - setPrice() Any compromise to the `Owner` account may allow a hacker to take advantage of this authority and withdraw all the MDT tokens and modify the critical configuration in the contract.

LowInconsistent exchange ratio descriptionFixed

The comment in line 18 and the formula in line 38 show exchange ratio for XCN and MDT is 1 to 1. ```sol= uint256 public mdtPrice = 1000000000000000000; // 1 XCN = 1 MDT ... uint256 _xcnAmount = _amount.mul(mdtPrice).div(10**PRICE_DECIMALS); ``` However, the comment in line 38 shows the ratio is `MDT = 0.5 XCN`. ```sol uint256 _xcnAmount = _amount.mul(mdtPrice).div(10**PRICE_DECIMALS); // Same decimals, and MDT = 0.5 XCN ``` The exchange ratio is inconsistent across the codebase.

LowToo Many DigitsFixed

Literals with many digits are difficult to read and review.

LowUnnecessary Use of SafeMathFixed

The `SafeMath` library is used unnecessarily. With Solidity compiler versions 0.8.0 or newer, arithmetic operations will automatically revert in case of integer overflow or underflow.