PBX - PBMaticPrediction

CertiK1 address on Polygon (POS)

CertiK reviewed Peerblue Exchange (PBX - PBMaticPrediction) on 19 Jan 2023: 8 findings, 0 critical; 3 marked fixed, 1 acknowledged, 4 open.

No open critical findings
Open the reportOpen Peerblue Exchange’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings8

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High100
Medium010
Low303
LowcloseTimestamp overwritten in the function `_safeFixed

According to the contract logic, the `closeTimestamp` is an important variable for the entire protocol and needs to be accurate. However, if there is an increase in transaction volumes in the blockchain, the network becomes congested. Hence the `closeTimestamp` could be different from the expected value in the lock phase. Additionally, the operator can cause the same result if not executed properly. Then the original `endRound` call at that time might fail because of the check failure `block.timestamp >= rounds[epoch].closeTimestamp` at line 1404. And the admin has to manually execute the rounds, which may be a great concern because the price updates turn out to be manually updated rather than timed triggering, affecting the fairness of the round. The delay of the `closeTimestamp` will always affect new rounds, making time-triggering price updates impossible.

LowLogical issue about function `executeRound()` andFixed

Each round starts when the previous round is locked, and the call time needs to match the time window of the lock phase and end phase. So it seems impossible to implement periodic rounds and it relies on the server or administrator to execute the rounds. Due to the time windows and the fact that prices change all the time, the timing of the operator call becomes very important. If the price change is slight, calling the function at any point within the time window will always make users from one side dissatisfied especially when the price is stable and the price. We would like the team to elaborate more on the operator calls to check if it is reliable and fair enough to satisfy the users' needs.

LowMissing Zero Address ValidationFixed

Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=900 adminAddress = _adminAddress; ``` - `_adminAddress` is not zero-checked before being used. --- ```solidity=901 operatorAddress = _operatorAddress; ``` - `_operatorAddress` is not zero-checked before being used.

Contracts in scope1

AddressChainSource code
0x52afcd78c3ba1cd6187c1d13fe12d5fc5d0fb3e2Chain: Polygon (POS)Source code: Verified source

Part of Peerblue Exchange’s security record

Peerblue Exchange
Audits1 audit by 1 firmLast audit Jan 2023, by CertiK.
Critical findingsNo open critical findingsIn 1 report.
Open Peerblue Exchange’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us