Kroma Network - Token Audit

CertiK3 Dec 20241 address on Ethereum

CertiK reviewed Kroma (Kroma Network - Token Audit) on 3 Dec 2024: 4 findings, 0 critical; 1 marked fixed, 3 acknowledged.

No open critical findings

Open the report Open Kroma’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings4

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	0	0
High	2	0
Medium	1	0
Low	0	1

HighCentralization Related RisksAcknowledged

In the contract `GovernanceToken`, the role `BRIDGE` and `_owner` have authority over the following function: - `mint` Any compromise to these accounts may allow the hacker to take advantage of this authority and mint tokens to a specified address. In the contract `GovernanceToken`, the role `BRIDGE` has authority over the following function: - `burn` Any compromise to the `BRIDGE` account may allow the hacker to take advantage of this authority and burn tokens from a specified address. In the contract `Ownable2StepUpgradeable`, the role `_owner` has authority over the following functions: - `transferOwnership` - `renounceOwnership` Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and transfer or renounce the ownership.

HighCentralized Control of Contract UpgradeAcknowledged

The contract `GovernanceToken` serves as the implementation contract behind its proxy contract, the role proxy admin has the authority to update the implementation contract. Any compromise to the proxy admin account may allow a hacker to take advantage of this authority and change the implementation contract which is pointed by proxy and therefore execute potential malicious functionality in the implementation contract.

MediumUpgradable contracts Inherits non-upgradable contAcknowledged

The contracts `GovernanceToken` inherit the following non-upgradeable contracts: 1. KromaMintableERC20 2. ERC20Votes 3. ERC20 There are no storage gaps preserved in these contracts. Any logic contract that acts as a base contract that needs to be inherited by other upgradeable children should have a reasonable size of storage gap preserved for the new state variable introduced by the future upgrades.