CertiK reviewed CleanCarbon.io (CleanCarbon) on 18 Sep 2023: 20 findings, 0 critical; 12 marked fixed, 1 acknowledged, 7 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 1 |
| Medium | 1 | 0 | 1 |
| Low | 6 | 0 | 10 |
There are `86_400` seconds in a day, so there are `86_400*30 = 2_592_000` seconds per month (assuming the convention that a month always counts as 30 days). However, the constant `secondPerMonth` is set to `259_200`, which is the amount of seconds per 3 days. This will cause the amount that is to be rewarded each month for the team developers to be rewarded every 3 days.
In the contract `stakingCarbon`, users stake `mainToken` in the contract. The `emergencyWithdraw()` function allows the `DEFAULT_ADMIN_ROLE` to withdraw any ERC20 token from the contract, including the staked `mainToken` of users.
The `ADMIN` role is only used in the `AirdropCarbonv2` contract to restrict `changeAdminRole`. Since the contract does not use the `ADMIN` role to restrict access to any functions not directly related to the role itself, it can be removed.
The `ADMIN` calls `addStakingPayload()`, to add additional staking options. This function would not be called unless the new staking option was intended to be active, as there is no functionality to change if a specific staking option is active. Thus, the `payload` does not need a parameter for `isActive` as it should always be true.
The contracts `StakingCarbon` and `CarboTokenv2` have `payable` constructors allowing native tokens to accidentaly be sent when deploying the contract that will be locked in the contract.
There should always be events emitted in the sensitive functions that are controlled by centralization roles. The functions linked above do not emit events.
Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=26 carboV1Addr = _tokenV1; ``` - `_tokenV1` is not zero-checked before being used. --- ```solidity=27 carboV2Addr = _tokenV2; ``` - `_tokenV2` is not zero-checked before being used. --- ```solidity=46 mainToken = _mainToken; ``` - `_mainToken` is not zero-checked before being used.
Suffixes like seconds, minutes, hours, days and weeks after literal numbers can be used to specify units of time where seconds are the base unit and units are considered naively in the following way: - 1 == 1 seconds; - 1 minutes == 60 seconds; - 1 hours == 60 minutes; - 1 days == 24 hours; - 1 weeks == 7 days;
In the contract `CarboTokenv2`: - The comment below `secondsPerMonth` is unnecessary and can be deleted. - The comment in the function `emergencyWithdraw()` is unnecessary and can be deleted. In the contract `AirdropCarbonv2`: - The comment in the function `emergencyWithdraw()` is unnecessary and can be deleted. In the contract `StakingCarbon`: - The comment in the function `emergencyWithdraw()` is unnecessary and can be deleted.
The `emergencyWithdraw()` interacts with any possible ERC20 tokens. Since some ERC20 tokens return no values and others return a `bool` value, they should be handled with care.
The check in the function `_mint()`, that `capSupply >= amount + totalSupply()` is unnecessary as the current implementation only allows a maximum of `500_000_000` tokens to be minted.
In the contract `CarboTokenv2` there are paramaters and variables that are never used: - In the `constructor()`, the parameters `buybacks` and `treasury` are never used. - The variable `CONTRACT_MANAGER` is defined and never used.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (4)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us