FintruX Network - Audit

CertiKFiles named in the report

Audit

CertiK reviewed FintruX Network (FintruX Network - Audit) on 5 Dec 2022: 18 findings, 0 critical; 10 marked fixed, 8 acknowledged.

No open critical findings
Open the reportOpen FintruX Network’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings18

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High010
Medium003
Low077
HighCentralization Related RisksAcknowledged

In the contract `FETHToken`, the role `admin` has authority over the following functions: - addMultipleValidators - removeValidator - updateValidatorBal - withdrawStakingRewards Any compromise to the `admin` account may allow a hacker to take advantage of this authority and modify the validator list or withdrawing staking reward to `f2eSwapAddress`. In the contract `FTXPriceFeed`, the role `owner` has authority over the following functions: - setPrice - setAddresses the role `admin` has authority over the following functions: - setTWAPInterval Any compromise to the aforementioned account may allow a hacker to take advantage of this authority and modify the price of FTX token,.

LowCalculation With `_decreaseTotalPAYDDeposits()`Acknowledged

The function `redistribute()` is called when liquidated, while the function `offset()` is called when users withdrawing collaterals. However, the function `_decreaseTotalPAYDDeposits` is called in `redistribute()`, but not in `offset()`.

LowDiscussion on Ether Deposit and the Mapping of ETAcknowledged

1. How are the Ethers transferred/deposited to the ActivePool (as well as other pools like MiningPool, RewardsPool and ValidatorPool)? Since there are no `receive()` or `fallback()` functions. The only legit token is FETH. Both ETH and PAYD only have the value stored. Indeed there are ways to store Ethers without `receive()` or `fallback()` functions, referring to Can a contract with no payable function have ether? - Ethereum Stack Exchange, we would like to confirm the use case of the assets flow of the pools 2. In the contract F2ESwap, how are ETH are FETH guaranteed to be 1:1, there seem to be no obvious checks/verifications in the implementation.

LowPotential Precision Loss on `truncateETH` and `trAcknowledged

The two variables `truncateETH` and `truncatePAYD` are used in contracts Snapshot, RewardsPool and Fees. We understand that the truncation operations are to improve human readability. However, the truncations would lead to potential precision loss, although the potential loss amount is relatively small. For example, in the function `_getETHGainFromSnapshots()` of the contract Snapshot, the variable `ETHGain` is truncated from `1e18` to `1e6` or `1e8`. (Please also review [SCL-01|Inconsistency on `truncateETH` And `truncatePAYD`]() for the inconsistency of `1e6` and `1e8` here.) The public function `snapshot.getDepositorETHLoss()` directly returns the return value of `_getETHGainFromSnapshots()`. All functions that call the function `snapshot.getDepositorETHLoss()` will be forced to adopt the truncation from `truncateETH`.

LowSwapping FETH to ETH Stuck in QueueAcknowledged

The function `_processETH()` implements an FETH queue to distribute ETH. For the case that if there is a deposit with a huge amount of money, the queue will be stuck, and then the deactivation balance will not be able to be updated accordingly.

LowTestnet AddressesAcknowledged

There are multiple addresses seems to be on testnets instead of the Ethereum mainnet: * BorrowerOperations: * `openWalletAddress` * `topupWalletAddress` * CacheManager: * paydSwapWalletAddress * F2ESwap: * `fethSwapWalletAddress` * FETHToken: * `stakingFeeWalletAddress` * `miningFeeWalletAddress` * `excessWalletAddress` * `fethSwapWalletAddress` * FTXStaking: * `ftxInventoryAddress` * KYCManager: * `charityWalletAddress`

LowThird Party DependenciesAcknowledged

The contract is serving as the underlying entity to interact with third party UniswapV3, Chainlink, Tellor and Ethereum staking deposit contracts. The scope of the audit treats 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.

LowUser deposit timestamp updated when the user remAcknowledged

In function stake, variable `stakes[msg.sender].since` is updated when user's stake amount reaches tier 1. However, in case of the user deposit does not change discount tier, the variable is still updated. Possible scenario: 1. User deposits 30000 FTX token to reach tier 1. 2. User deposits another 30000 FTX token. After the deposit, the user is still in tier 1, but the timestamp is updated.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (68)

  • stakedfinancing-coinspect/packages/contracts/contracts/HintHelpers.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Interfaces/IPAYDToken.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/FETHToken.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Migrations.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/F2ESwap.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/SortedCaches.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Dependencies/TickMath.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/CollSurplusPool.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Interfaces/IStakedfinanceBase.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Interfaces/ICollSurplusPool.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/MiningPool.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/ValidatorPool.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Dependencies/AggregatorV3Interface.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Interfaces/IRewardsPool.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Dependencies/LiquityMath.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Dependencies/ITellor.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/GasPool.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/DefaultPool.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/FTXStaking.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Dependencies/pool/IUniswapV3PoolActions.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Interfaces/IBorrowerOperations.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Interfaces/IMiningPool.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Interfaces/ISortedCaches.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Dependencies/LiquitySafeMath128.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/PAYDToken.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/ActivePool.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/RewardsPool.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Dependencies/IUniswapV3Pool.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/BorrowerOperations.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/MultiCacheGetter.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Dependencies/pool/IUniswapV3PoolEvents.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Dependencies/pool/IUniswapV3PoolOwnerActions.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Dependencies/console.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Dependencies/Context.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Dependencies/BaseMath.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Dependencies/pool/IUniswapV3PoolDerivedState.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Interfaces/IKYCManager.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Dependencies/SafeMath.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Interfaces/IActivePool.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/PriceFeed.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Snapshot.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Dependencies/pool/IUniswapV3PoolState.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Interfaces/IFETHToken.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/KYCManager.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Interfaces/IFTXStaking.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Interfaces/IF2ESwap.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Dependencies/OwnableUpgradeable.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Dependencies/IERC2612.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/ERC1967Proxy.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Dependencies/Ownable.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Interfaces/ISnapshot.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Interfaces/ICacheManager.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Dependencies/IERC20.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Dependencies/FullMath.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Interfaces/IValidatorPool.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/FTXPriceFeed.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Dependencies/pool/IUniswapV3PoolImmutables.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Dependencies/CheckContract.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Interfaces/IDepositContract.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Interfaces/IPriceFeed.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Dependencies/TellorCaller.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Fees.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Dependencies/StakedfinanceBase.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Interfaces/IFees.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Interfaces/ITellorCaller.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Interfaces/IPool.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/CacheManager.sol
  • stakedfinancing-coinspect/packages/contracts/contracts/Interfaces/IDefaultPool.sol

Part of FintruX Network’s security record

FintruX Network
Audits1 audit by 1 firmLast audit Dec 2022, by CertiK.
Critical findingsNo open critical findingsIn 1 report.
Open FintruX Network’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us