DigiVerse Staking - Audit

CertiK5 Jan 2024Files named in the report

CertiK reviewed Digiverse (DigiVerse Staking - Audit) on 5 Jan 2024: 13 findings, 2 critical; 10 marked fixed, 3 acknowledged.

1 critical acknowledged, not fixed

Open the report Open Digiverse’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings13

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	1	1
High	2	4
Medium	0	1
Low	0	4

CriticalFinancial modelAcknowledged

The staking contract employs a hierarchical referral system, where participants earn commissions or rewards for recruiting new members. The reward seems to be distributed to the contract by the project team. However, if the token is not filled to the contract company, either the user cannot withdraw his deposits, or user's deposit can be withdrawn by other people.

HighCentralization Risks in digistake.solAcknowledged

In the contract `DigiStake` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and change important parameters about the staking contract and transfer ERC 20 token other than staking token out of the contract. ![](https://accelerator-tasks-prod.acc.corp.certik.com/11ee-9bc5-121f7c60-953e-97f7ecbf1605/diagrams/centralization_digistake-DigiStake-_owner.svg)

HighLack of TestsAcknowledged

There is no unit tests for the provided codebase. Testing programs are a very important aspect of proving program correctness, preventing regressions, and release engineering. Without tests, there is no way to know if the program works as expected. The fact that the code was submitted for review with such a significant flaw is regarded as an indicator of issues within the release engineering procedures. This could potentially result in unintended changes being deployed to the production environment.