EtherFi

CertiKFiles named in the report

CertiK reviewed ether.fi (EtherFi) on 25 Feb 2023: 5 findings, 0 critical; 3 marked fixed, 2 open.

No open critical findings
Open the reportOpen ether.fi’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings5

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High100
Medium001
Low102
MediumIncorrect Total User BalanceFixed

According to the comment of the function `calculateUserPoints()`, the function is used to calculate how many points a user currently has accumulated. The argument `_user` represent the real user account. However, the total user balance is calculated based on both of the balance of the `_user` and `msg.sender`. The `_user` may not be equal to `msg.sender`. ```solidity=181 /// @notice Calculates how many points a user currently has owed to them /// @return the amount of points a user currently has accumulated function calculateUserPoints(address _user) public view returns (uint256) { uint256 lengthOfDeposit; if (claimingOpen == 0) { lengthOfDeposit = block.timestamp - depositInfo[_user].depositTime; } else { lengthOfDeposit = endTime - depositInfo[_user].depositTime; } //Variable to store how many milestones (3 days) the user deposit lasted uint256 numberOfMultiplierMilestones = lengthOfDeposit / 259200; if (numberOfMultiplierMilestones > 10) { numberOfMultiplierMilestones = 10; } uint256 userMultiplier = numberOfMultiplierMilestones * multiplierCoefficient; uint256 totalUserBalance = depositInfo[_user].etherBalance + depositInfo[msg.sender].totalERC20Balance; //Formula for calculating points total return (((Math.sqrt(totalUserBalance) * lengthOfDeposit) / SCALE) * userMultiplier) / 100; } ```

LowQuestionable Total User Balance in `transferFundsFixed

In L219, the value of `totalUserBalance` is calculated by plusing the number of native tokens of `msg.sender` and the number of erc20 tokens that `msg.sender` has deposited into the current contract. It is weird to plus different asset's balances from a different account. Since the value is just used to emit events, we couldn't understand this variable quite well. ```solidity=218 function transferFunds(uint256 _identifier) internal returns (uint256) { uint256 totalUserBalance = msg.sender.balance + depositInfo[msg.sender].totalERC20Balance; ```

LowVariables That Could Be Declared as ImmutableFixed

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (1)

  • src/EarlyAdopterPool.sol

Part of ether.fi’s security record

ether.fi
Audits3 audits by 3 firmsLast audit Aug 2024, by Decurity.
Critical findingsNo open critical findingsAcross the 3 reports, 5 critical findings were reported. Each is marked fixed by the firm that reported it.
Open ether.fi’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us