CleanCarbon

CertiKFiles named in the report

CertiK reviewed CleanCarbon.io (CleanCarbon) on 18 Sep 2023: 20 findings, 0 critical; 12 marked fixed, 1 acknowledged, 7 open.

No open critical findings
Open the reportOpen CleanCarbon.io’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings20

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High011
Medium101
Low6010
HighIncorrect `secondsPerMonth`Fixed

There are `86_400` seconds in a day, so there are `86_400*30 = 2_592_000` seconds per month (assuming the convention that a month always counts as 30 days). However, the constant `secondPerMonth` is set to `259_200`, which is the amount of seconds per 3 days. This will cause the amount that is to be rewarded each month for the team developers to be rewarded every 3 days.

Medium`emergencyWithdraw()` Can Transfer Users Staked TFixed

In the contract `stakingCarbon`, users stake `mainToken` in the contract. The `emergencyWithdraw()` function allows the `DEFAULT_ADMIN_ROLE` to withdraw any ERC20 token from the contract, including the staked `mainToken` of users.

Low`ADMIN` Role Not Used In `AirdropCarbonv2`Fixed

The `ADMIN` role is only used in the `AirdropCarbonv2` contract to restrict `changeAdminRole`. Since the contract does not use the `ADMIN` role to restrict access to any functions not directly related to the role itself, it can be removed.

Low`isActive` DiscussionFixed

The `ADMIN` calls `addStakingPayload()`, to add additional staking options. This function would not be called unless the new staking option was intended to be active, as there is no functionality to change if a specific staking option is active. Thus, the `payload` does not need a parameter for `isActive` as it should always be true.

LowLocked EtherFixed

The contracts `StakingCarbon` and `CarboTokenv2` have `payable` constructors allowing native tokens to accidentaly be sent when deploying the contract that will be locked in the contract.

LowMissing Emit EventsFixed

There should always be events emitted in the sensitive functions that are controlled by centralization roles. The functions linked above do not emit events.

LowMissing Zero Address ValidationFixed

Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=26 carboV1Addr = _tokenV1; ``` - `_tokenV1` is not zero-checked before being used. --- ```solidity=27 carboV2Addr = _tokenV2; ``` - `_tokenV2` is not zero-checked before being used. --- ```solidity=46 mainToken = _mainToken; ``` - `_mainToken` is not zero-checked before being used.

LowTime Units Can Be Used DirectlyFixed

Suffixes like seconds, minutes, hours, days and weeks after literal numbers can be used to specify units of time where seconds are the base unit and units are considered naively in the following way: - 1 == 1 seconds; - 1 minutes == 60 seconds; - 1 hours == 60 minutes; - 1 days == 24 hours; - 1 weeks == 7 days;

LowTyposFixed

In the contract `CarboTokenv2`: - The comment below `secondsPerMonth` is unnecessary and can be deleted. - The comment in the function `emergencyWithdraw()` is unnecessary and can be deleted. In the contract `AirdropCarbonv2`: - The comment in the function `emergencyWithdraw()` is unnecessary and can be deleted. In the contract `StakingCarbon`: - The comment in the function `emergencyWithdraw()` is unnecessary and can be deleted.

LowUnchecked ERC-20 `transfer()`/`transferFrom()` CaFixed

The `emergencyWithdraw()` interacts with any possible ERC20 tokens. Since some ERC20 tokens return no values and others return a `bool` value, they should be handled with care.

Show 2 more
LowUnnecessary CheckFixed

The check in the function `_mint()`, that `capSupply >= amount + totalSupply()` is unnecessary as the current implementation only allows a maximum of `500_000_000` tokens to be minted.

LowUnused Parameters And VariablesFixed

In the contract `CarboTokenv2` there are paramaters and variables that are never used: - In the `constructor()`, the parameters `buybacks` and `treasury` are never used. - The variable `CONTRACT_MANAGER` is defined and never used.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (4)

  • contracts/v1/interfaces/ICarboToken.sol
  • contracts/StakingCarbon.sol
  • contracts/CarboTokenv2.sol
  • contracts/AirdropCarbonv2.sol

Part of CleanCarbon.io’s security record

CleanCarbon.io
Audits2 audits by 2 firmsLast audit Sep 2023, by CertiK.
Critical findingsNo open critical findingsAcross 2 reports.
Open CleanCarbon.io’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us