Xave Finance 2nd audit

CertiKFiles named in the report

CertiK reviewed HaloDAO (Xave Finance 2nd audit) on 6 May 2022: 6 findings, 0 critical; 2 marked fixed, 4 acknowledged.

No open critical findings
Open the reportOpen HaloDAO’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings6

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium002
Low040
LowDeclaration Naming ConventionAcknowledged

One or more declarations do not conform to the [Solidity style guide](https://solidity.readthedocs.io/en/v0.7.3/style-guide.html#naming-conventions) with regards to its naming convention. Particularly: - `camelCase`: Should be applied to function names, argument names, local and state variable names, modifiers - `UPPER_CASE`: Should be applied to `constant` variables - `CapWords`: Should be applied to contract names, struct names, event names and enums File: contracts/HLPPriceFeedOracle.sol (Line 12) ```solidity contract hlpPriceFeedOracle { ``` - Contract `hlpPriceFeedOracle` is not in `CapWords`. --- File: contracts/HLPPriceFeedOracle.sol (Line 7) ```solidity interface hlpContract { ``` - Contract `hlpContract` is not in `CapWords`. --- File: contracts/PriceFeed.sol (Line 6) ```solidity contract fxPriceFeed { ``` - Contract `fxPriceFeed` is not in `CapWords`.

LowFunction Should Be Declared ExternalAcknowledged

The functions which are never called internally within the contract should have external visibility for gas optimization. File: contracts/HLPPriceFeedOracle.sol (Line 33, Contract `hlpPriceFeedOracle`) ```solidity function latestAnswer() public view returns (int256) { ``` --- File: contracts/PriceFeed.sol (Line 25, Contract `fxPriceFeed`) ```solidity function latestAnswer() public view returns (int256) { ```

LowUsage of Decentralized OracleAcknowledged

Currently, the data is being queried from chainlink as per the testing files. Chainlink provides a reliable manipulation resistant price feed for blockchain data. It should be noted that if the data is queried from another oracle such as a liquidity pool the data may no longer be manipulation resistant.

LowVariables That Could Be Declared as ImmutableAcknowledged

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (2)

  • contracts/HLPPriceFeedOracle.sol
  • contracts/PriceFeed.sol

Part of HaloDAO’s security record

HaloDAO
Audits1 audit by 1 firmLast audit May 2022, by CertiK.
Critical findingsNo open critical findingsIn 1 report.
IncidentIncident 7 Oct 2022Source: De.Fi incident database.
Open HaloDAO’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us