ICPLAZA - Ⅱ

CertiK17 Oct 2022Files named in the report

Audit

CertiK reviewed Icplaza (ICPLAZA - Ⅱ) on 17 Oct 2022: 15 findings, 0 critical; 11 marked fixed, 3 acknowledged, 1 open.

No open critical findings

Open the report Open Icplaza’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings15

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	3	0
Medium	0	0	1
Low	1	0	10

Medium`_hashUsed` is not updated in `burnLock()`Fixed

`_hashUsed` is used to prevent repetitive call of the same function as a reaction to the same transactions. However, in `burnLock()` the check is done, but the mapping is not updated. This practically disables the protection.

Low`IERC20` interface name doesn't reflect the functFixed

`IERC20` interface is not relevant to ERC20 standard.

Low`onlyMiner` is supposed to be `onlyMinter`Fixed

`onlyMiner` modifier is supposed to be `onlyMinter`.

LowComments Should Be in EnglishFixed

Code commented in Chinese.

LowDeclaration Naming ConventionFixed

The linked declarations do not conform to the [Solidity style guide](https://solidity.readthedocs.io/en/v0.7.3/style-guide.html#naming-conventions) with regards to its naming convention. `public` functions and state fields names should not start with `_`.

LowImproper Usage of `public` and `external` TypeFixed

`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.

LowMissing Zero Address ValidationFixed

Addresses should be checked before assignment or external call to make sure they are not zero addresses.

LowPotential Reentrancy AttackFixed

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. `mint()`, `lock()`, `burnLock()`, `freeLock()` update the state or emit events after the external call.

LowUnchecked ERC-20 `transfer()`/`transferFrom()` CaFixed

The return value of the `transfer()/transferFrom()` call is not checked.

LowUnused State VariableFixed

Variable `_minters` in `TRONChannel` is never used in `TRONChannel`.

Show 1 more

LowVariables That Could Be Declared as ImmutableFixed

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.