Beans DAO - Audit

CertiK19 Aug 2022Files named in the report

CertiK reviewed Beans DAO (Beans DAO - Audit) on 19 Aug 2022: 10 findings, 0 critical; 2 marked fixed, 2 acknowledged, 6 open.

No open critical findings

Open the report Open Beans DAO’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings10

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	2	0	0
Medium	0	2	0
Low	4	0	2

MediumLack of Storage Gap in Upgradeable ContractsAcknowledged

For upgradeable contracts, there must be storage gap to "allow developers to freely add new state variables in the future without compromising the storage compatibility with existing deployments". Otherwise it may be very difficult to write new implementation code, or risk storage slot collision. See https://docs.openzeppelin.com/upgrades-plugins/1.x/writing-upgradeable

MediumUninitialized Variable in Function `initialize()`Acknowledged

In BeansAuctionHouse contract, function `initialize()` doesn't initiate the variable `auction`. If this contract gets upgraded, the `auction` variable may still contain the old value and cause unexpected behavior.