CleanCarbon

CertiKFiles named in the report

CertiK reviewed CleanCarbon.io (CleanCarbon) on 18 Sep 2023: 20 findings, 0 critical; 12 marked fixed, 1 acknowledged, 7 open.

No open critical findings
Open the reportOpen CleanCarbon.io’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings20

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High011
Medium101
Low6010
MediumRewards For `teamDev` Can Be Released EarlyOpen

The `latestUpdateForTeamDev` in the `constructor()` can be set to any initial value. In particular, it can be set to a value that is not a multiple of `secondsPerMonth`, which allows for rewards to be released earlier than expected. In addition, `latestUpdateForTeamDev` is set in the `constructor()` with no upper or lower bounds. If this value is set to a low value accidentally, then it is possible for the `teamDev` to be rewarded the `maxTokenForDev` as soon as the contract is deployed. If this value is set to a value much higher than the `block.timestamp`, then the `teamDev` may not be eligible for rewards when they should.

Low`changeAdminRole()` RestrictionOpen

The function `changeAdminRole()` can only be called by the `ADMIN`. However, the `DEFAULT_ADMIN_ROLE` can still grant and revoke the `ADMIN` role through the `grantRole()` and `revokeRole()` functions as it is the admin of all roles by default. This in particular allows there to be multiple addresses with the `ADMIN` role.

LowCalling Void ConstructorOpen

Calling an undefined parent constructor has no effect. The `constructor()` of the contracts `AirdropCarbonv2`, `CarboTokenv2`, and `StakingCarbon` all call `AccessControl()` which does not have a defined constructor.

LowCan Use `delete` To Save GasOpen

When a user calls `unstake()`, the `userStateStorage[msg.sender]` is set back to the default values of `0` by hand. This can instead be done using the `delete` operator saving around 4007 gas on deployment and 63 gas on each function call. See the documentation on `delete` here: [Solidity Delete Documentation](https://docs.soliditylang.org/en/v0.8.17/types.html?highlight=delete#delete:~:text=after%20the%20change.-,delete,only%20reset%20a%20itself%2C%20not%20the%20value%20it%20referred%20to%20previously.,-//%20SPDX%2DLicense%2DIdentifier).

LowMinting To `address(1)`Open

On contract deployment `80_000_000` tokens are minted to `address(1)`, which is a null address and will cause those tokens to be unusable. As the tokens are not available, they should not be accounted for in the total supply. However, as they are minted to `address(1)`, they will be included in the total supply of the token.

LowPossibly Inefficient Memory ParameterOpen

One or more parameters with `memory` data location are never modified in their functions and those functions are never called internally within the contract. Thus, their data location can be changed to `calldata` to avoid the gas consumption copying from calldata to memory. ```solidity=54 function addStakingPayload(StakingOptions memory payload) ``` `addStakingPayload` has memory location parameters: `payload`. This change will increase the deployment cost by around `7813` gas, while saving around `61` gas on each function call.

LowVariables That Could Be Declared as ImmutableOpen

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (4)

  • contracts/v1/interfaces/ICarboToken.sol
  • contracts/StakingCarbon.sol
  • contracts/CarboTokenv2.sol
  • contracts/AirdropCarbonv2.sol

Part of CleanCarbon.io’s security record

CleanCarbon.io
Audits2 audits by 2 firmsLast audit Sep 2023, by CertiK.
Critical findingsNo open critical findingsAcross 2 reports.
Open CleanCarbon.io’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us