CertiK reviewed CleanCarbon.io (CleanCarbon) on 18 Sep 2023: 20 findings, 0 critical; 12 marked fixed, 1 acknowledged, 7 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 1 |
| Medium | 1 | 0 | 1 |
| Low | 6 | 0 | 10 |
The `latestUpdateForTeamDev` in the `constructor()` can be set to any initial value. In particular, it can be set to a value that is not a multiple of `secondsPerMonth`, which allows for rewards to be released earlier than expected. In addition, `latestUpdateForTeamDev` is set in the `constructor()` with no upper or lower bounds. If this value is set to a low value accidentally, then it is possible for the `teamDev` to be rewarded the `maxTokenForDev` as soon as the contract is deployed. If this value is set to a value much higher than the `block.timestamp`, then the `teamDev` may not be eligible for rewards when they should.
The function `changeAdminRole()` can only be called by the `ADMIN`. However, the `DEFAULT_ADMIN_ROLE` can still grant and revoke the `ADMIN` role through the `grantRole()` and `revokeRole()` functions as it is the admin of all roles by default. This in particular allows there to be multiple addresses with the `ADMIN` role.
Calling an undefined parent constructor has no effect. The `constructor()` of the contracts `AirdropCarbonv2`, `CarboTokenv2`, and `StakingCarbon` all call `AccessControl()` which does not have a defined constructor.
When a user calls `unstake()`, the `userStateStorage[msg.sender]` is set back to the default values of `0` by hand. This can instead be done using the `delete` operator saving around 4007 gas on deployment and 63 gas on each function call. See the documentation on `delete` here: [Solidity Delete Documentation](https://docs.soliditylang.org/en/v0.8.17/types.html?highlight=delete#delete:~:text=after%20the%20change.-,delete,only%20reset%20a%20itself%2C%20not%20the%20value%20it%20referred%20to%20previously.,-//%20SPDX%2DLicense%2DIdentifier).
On contract deployment `80_000_000` tokens are minted to `address(1)`, which is a null address and will cause those tokens to be unusable. As the tokens are not available, they should not be accounted for in the total supply. However, as they are minted to `address(1)`, they will be included in the total supply of the token.
One or more parameters with `memory` data location are never modified in their functions and those functions are never called internally within the contract. Thus, their data location can be changed to `calldata` to avoid the gas consumption copying from calldata to memory. ```solidity=54 function addStakingPayload(StakingOptions memory payload) ``` `addStakingPayload` has memory location parameters: `payload`. This change will increase the deployment cost by around `7813` gas, while saving around `61` gas on each function call.
The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (4)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us