Celer Layer2 Finance v2

CertiK25 Jun 2021Files named in the report

CertiK reviewed Celer Network (Celer Layer2 Finance v2) on 25 Jun 2021: 22 findings, 0 critical; 8 marked fixed, 14 open.

No open critical findings

Open the report Open Celer Network’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings22

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	0	0
Medium	0	0
Low	14	8

LowAddress parameters not verifiedOpen

The linked address parameters are not verified to be non-zero before assigning them to state variable which cannot be modified in the future.

LowAnyone can induce a withdraw for an arbitrary accOpen

The external `withdraw` and `withdrawETH` functions in the `RollupChain` contract both take an arbitrary `_account` address parameter instead of utilizing `msg.sender`, which allows anyone to request a withdraw for a particular account without permission for `msg.sender` to do so, which may be undesired by the account owning the funds.

LowArbitrary wETH address parametersOpen

The linked lines contain arbitrary address parameters which are intended to represent the wETH address.

LowAsset not verified to exist in registry before drOpen

The external `drainToken` function in the `RollupChain` contract does not verify if the supplied `_asset` address exists within the `registry` prior to the transfer.

LowOwner can change block challenge period at any tiOpen

The external `setBlockChallengePeriod` function in the `RollupChain` contract allows the owner to change the period in which blocks are allowed to be challenged at any time.

LowOwner can change maximum priority transaction delOpen

The external `setMaxPriorityTxDelay` function in the `RollupChain` contract allows the owner to change the maximum priority transaction delay at any time.

LowOwner can change strategy implementation at any tOpen

The owner of the contract can change the implementation address associated with the supplied `_strategyId` at any time

LowOwner can drain any ERC-20 when pausedOpen

The external `drainToken` function in the `RollupChain` contract allows the owner of the contract to drain any specified ERC-20 token when the contract is in a paused state.

LowOwner can drain ETH sent to contract when pausedOpen

The external `drainETH` function in the `RollupChain` contract allows the owner of the contract to drain any ETH sent to the contract when the contract is in a paused state.

LowOwner can set net deposit limit for any existingOpen

The external `setNetDepositLimit` function in the `RollupChain` contract allow the owner to set the net deposit limit for the supplied `_asset` at any time.

Show 4 more

LowRedundant reading of state variables from storageOpen

The linked lines read state variables from storage redundantly, which is inefficient.

LowUnchecked casting of uint to lower bit count contOpen

The linked lines may truncate due to casting `uint` values with a higher bit count into `uint` values with a lower bit count without verifying that the `uint` values with higher bit counts are valid within the bounds of a `uint` value with a lower bit count.

LowUnrestricted receive function allows anyone to seOpen

The receive function in the `RollupChain` contract allows anyone to send ETH to the contract, which can be unintentional.

LowWithdraws larger than net deposit are truncatedOpen

The private `_withdraw` function in the `RollupChain` contract allows the `pendingWithdraws` value for the supplied `_account` and `_asset` to be larger than what is available in `netDeposits` for the supplied `_asset`. This is possible due to setting the `netDeposits` for the supplied `_asset` to zero on L526 and setting the `pendingWithdraws` for the supplied `_account` and `_asset` to zero on L530, effectively truncating the withdraw to only what is available in `netDeposits` for the supplied `_asset` without emitting an event or tracking how much the withdraw was truncated by. The function also returns the amount that was requested in `pendingWithdraws` instead of the actual amount that was available in `netDeposits`, which can affect any functionality relying on the result of the function.