CertiK reviewed HaloDAO (Xave Finance 2nd audit) on 6 May 2022: 6 findings, 0 critical; 2 marked fixed, 4 acknowledged.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 2 |
| Low | 0 | 4 | 0 |
One or more declarations do not conform to the [Solidity style guide](https://solidity.readthedocs.io/en/v0.7.3/style-guide.html#naming-conventions) with regards to its naming convention. Particularly: - `camelCase`: Should be applied to function names, argument names, local and state variable names, modifiers - `UPPER_CASE`: Should be applied to `constant` variables - `CapWords`: Should be applied to contract names, struct names, event names and enums File: contracts/HLPPriceFeedOracle.sol (Line 12) ```solidity contract hlpPriceFeedOracle { ``` - Contract `hlpPriceFeedOracle` is not in `CapWords`. --- File: contracts/HLPPriceFeedOracle.sol (Line 7) ```solidity interface hlpContract { ``` - Contract `hlpContract` is not in `CapWords`. --- File: contracts/PriceFeed.sol (Line 6) ```solidity contract fxPriceFeed { ``` - Contract `fxPriceFeed` is not in `CapWords`.
The functions which are never called internally within the contract should have external visibility for gas optimization. File: contracts/HLPPriceFeedOracle.sol (Line 33, Contract `hlpPriceFeedOracle`) ```solidity function latestAnswer() public view returns (int256) { ``` --- File: contracts/PriceFeed.sol (Line 25, Contract `fxPriceFeed`) ```solidity function latestAnswer() public view returns (int256) { ```
Currently, the data is being queried from chainlink as per the testing files. Chainlink provides a reliable manipulation resistant price feed for blockchain data. It should be noted that if the data is queried from another oracle such as a liquidity pool the data may no longer be manipulation resistant.
The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (2)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us