L2Finance

CertiKFiles named in the report

CertiK reviewed L2Finance on 2 May 2023: 11 findings, 0 critical; 7 marked fixed, 4 acknowledged.

No open critical findings
Open the reportOpen L2Finance’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings11

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High020
Medium021
Low006
MediumNo Upper Limit for sellBurnFeeFixed

There are no upper boundaries for **sellBurnFee**. It is possible to set the total fee rate up to any arbitrary amount.

LowDivide Before MultiplyFixed

Performing integer division before multiplication truncates the low bits, losing the precision of calculation. ```solidity=727 uint256 burnAmount = amountL2FIIn.div(1000).mul(sellBurnFee); ``` --- ```solidity=820 uint256 burnedAmount = excludeFee[msg.sender] ? 0 : amountL2FIIn.div(1000).mul(sellBurnFee); ```

LowexcludeFee not consideredFixed

In the view function `estimatedUSDTOut()`, unlike the function `swapForUSDT`, the `excludeFee` logic is not considered. Hence it might not return accurate values for excludeFee users.

LowMissing Zero Address ValidationFixed

Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=599 _usdtAddr = USDTAddr; ``` - `USDTAddr` is not zero-checked before being used. --- ```solidity=600 _key = key; ``` - `key` is not zero-checked before being used. --- ```solidity=684 _key = _value; ``` - `_value` is not zero-checked before being used.

LowRedundant StatementsFixed

The linked statements do not affect the functionality of the codebase. The contract has to maintain two different mappings: _swap and _swapAllow. However, they have no obvious differences. The internal function `_burnFrom()` is defined but never called. The `reclaimEther()` function is redundant since there is no payable function or receive() function in the contract.

LowUnchecked ERC-20 `transfer()`/`transferFrom()` CaFixed

The return value of the transfer()/transferFrom() call is not checked. ```solidity=531 IERC20(token).transfer(owner(),amount); ```

LowVariables That Could Be Declared as ImmutableFixed

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (1)

  • src/L2Finance.sol

Part of L2Finance’s security record

L2Finance
Audits1 audit by 1 firmLast audit May 2023, by CertiK.
Critical findingsNo open critical findingsIn 1 report.
Open L2Finance’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us