1inch Exchange

CertiK15 Nov 2020Files named in the report

CertiK reviewed 1inch Network (1inch Exchange) on 15 Nov 2020: 8 findings, 0 critical; 3 marked fixed, 5 open.

No open critical findings

Open the report Open 1inch Network’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings8

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	0	0
Medium	1	0
Low	4	3

MediumPausable contract not externally unpausableOpen

The `_unpause` function in the `Pausable` contract is not exposed, meaning that an accidental invocation of the `pause` function is irreversible.

LowNon-optimal flags storage typeOpen

The `flags` variable could be reduced in size to be tight-packed with the address declaration that follows it by setting its size to `uint96` permitting 96 different flags. This would reduce the total storage cost of the `SwapDescription` to 7 from 8 if we do not factor in the `permit` variable.

LowUnlocked Solidity compiler versionsOpen

An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to ambiguity when debugging as compiler-specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

LowUnnecessary `else` statement in `uniBalanceOf` imOpen

The `uniBalanceOf` function can skip the `else`-block implementation and directly return the specific value after the `if`-condition is not me

LowUsage of if-revert pattern over requireOpen

The `swap` function in the `OneInchExchange` contract contains the usage of the if-revert pattern over using a require clause, which may be deprecated in the future: ```solidity if (!desc.flags.isDiscountChi()) { revert(RevertReasonParser.parse(reason, "Swap failed: ")); } ```