CertiK reviewed CleanCarbon.io (CleanCarbon) on 18 Sep 2023: 20 findings, 0 critical; 12 marked fixed, 1 acknowledged, 7 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 1 |
| Medium | 1 | 0 | 1 |
| Low | 6 | 0 | 10 |
In the contract `CarboTokenv2` the role `ADMIN` has authority over the functions shown in the diagram below. Any compromise to the `ADMIN` account may allow the hacker to take advantage of this authority and change the address of the `ADMIN` role or send the tokens allocated for airdrop to any address that they wish.  --- In the contract `StakingCarbon` the role `ADMIN` has authority over the functions shown in the diagram below. Any compromise to the `ADMIN` account may allow the hacker to take advantage of this authority and change the address with the `ADMIN` role or add any staking option they wish.  --- In the contract `AirdropCarbonv2` the role `ADMIN` has authority over the functions shown in the diagram below. Any compromise to the `ADMIN` account may allow the hacker to take advantage of this authority and change the address of the `ADMIN` role.  --- In the contract `CarboTokenv2`, `StakingCarbon`, and `AirdropCarbonv2` the role `DEFAULT_ADMIN_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow the hacker to take advantage of this authority and withdraw any ERC20 token held by the contract.  In addition, the DEFAULT_ADMIN_ROLE can also grant or revoke the ADMIN role.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (4)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us