Celer Layer2 Finance v2

CertiK25 Jun 2021Files named in the report

CertiK reviewed Celer Network (Celer Layer2 Finance v2) on 25 Jun 2021: 22 findings, 0 critical; 8 marked fixed, 14 open.

No open critical findings

Open the report Open Celer Network’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings22

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	0	0
Medium	0	0
Low	14	8

LowIneffectual statementFixed

The private `_revertBlock` function in the `RollupChain` contract contains an ineffectual statement in a while loop at L687.

LowMissing visibility specifiersFixed

The linked lines have missing visibility specifiers, which may result in undesired behavior for sharing between contracts.

LowMixed usage of require and returning error messagFixed

The external `disputeTransition` function in the `TransitionDisputer` contract contains mixed usage of require statements and returning error messages. In the event of returning an error message, no actual reversion is happening.

LowState variables can be declared immutableFixed

The state variable declared on the linked lines are mutable, yet are only ever assigned to in the contract's constructor.

LowUnlocked solidity version pragmaFixed

The contract specifies an unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

LowUnnecessary abicoder v2 pragmaFixed

The linked line explicitly specifies `pragma abicoder v2`, which is unnecessary due to the feature being enabled by default in Solidity v0.8.0 and above.

LowUnnecessary fallback functionFixed

The fallback function in the `RollupChain` contract is unnecessary as it allows nonstandard function selectors and does not contain any actual logic.

LowUnnecessary local variable declarationFixed

The linked local variable declaration is unnecessary and its value can be supplied to the call to `blocks.push` on L264.