CertiK reviewed MAP Protocol on 5 Jan 2023: 73 findings, 4 critical; 67 marked fixed, 3 acknowledged, 3 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 4 |
| High | 0 | 3 | 4 |
| Medium | 0 | 0 | 5 |
| Low | 3 | 0 | 54 |
When transferring standard ERC20 deflationary tokens, the input amount may not be equal to the received amount due to the charged transaction fee. As a result, an inconsistency in the amount will occur and the transaction may fail due to the validation checks. For example, if a user sends 100 deflationary tokens (with a 10% transaction fee) to the target contract, only 90 tokens actually arrived in the contract.
**mcs/evm/contracts/MAPCrossChainServiceRelay.sol** ```solidity function _transferInOtherChain(transferOutEvent memory outEvent, uint256 outAmount, bytes memory toChainToken) internal checkOrder(outEvent.order_id) nonReentrant whenNotPaused { //... uint256 outMap = getToChainAmount(mapToken, outEvent.to_chain, selfChainId, outAmount); uint256 feeMap = getChainFee(outEvent.to_chain, mapTokenAddress, outMap); uint256 fee = getToChainAmount(mapToken, selfChainId, outEvent.to_chain, feeMap); outAmount = outAmount.sub(fee); if (checkAuthToken(mapTokenAddress)) { IMAPToken(mapTokenAddress).mint(address(this), outMap); IMAPToken(mapTokenAddress).burn(outMap.sub(feeMap)); } //... } ``` In the function `_transferInOtherChain()`, if `mapTokenAddress` is an `AuthToken`, the function `mint()` of `IMAPToken` will be called first to increase the balance of the contract, followed by the function `burn()` to decrease the balance of the contract. If it only mints the difference in the number of tokens to the contract, the `burn()` function could be removed.
There is the risk that problems will arise because of RLP encoding compatibility issues. Recursive Length Prefix (RLP) serialization is used extensively in Ethereum's execution clients. RLP standardizes the transfer of data between nodes in a space-efficient format. The purpose of RLP is to encode arbitrarily nested arrays of binary data. RLP is the primary encoding method used to serialize objects in Ethereum's execution layer. The main purpose of RLP is to encode structures. The current RLP encoder and decoder are not in compliance with Ethereum RLP guidelines (https://ethereum.org/en/developers/docs/data-structures-and-encoding/rlp#definition) and implementations.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (48)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us