CertiK reviewed ether.fi (EtherFi) on 25 Feb 2023: 5 findings, 0 critical; 3 marked fixed, 2 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 0 | 0 |
| Medium | 0 | 0 | 1 |
| Low | 1 | 0 | 2 |
According to the comment of the function `calculateUserPoints()`, the function is used to calculate how many points a user currently has accumulated. The argument `_user` represent the real user account. However, the total user balance is calculated based on both of the balance of the `_user` and `msg.sender`. The `_user` may not be equal to `msg.sender`. ```solidity=181 /// @notice Calculates how many points a user currently has owed to them /// @return the amount of points a user currently has accumulated function calculateUserPoints(address _user) public view returns (uint256) { uint256 lengthOfDeposit; if (claimingOpen == 0) { lengthOfDeposit = block.timestamp - depositInfo[_user].depositTime; } else { lengthOfDeposit = endTime - depositInfo[_user].depositTime; } //Variable to store how many milestones (3 days) the user deposit lasted uint256 numberOfMultiplierMilestones = lengthOfDeposit / 259200; if (numberOfMultiplierMilestones > 10) { numberOfMultiplierMilestones = 10; } uint256 userMultiplier = numberOfMultiplierMilestones * multiplierCoefficient; uint256 totalUserBalance = depositInfo[_user].etherBalance + depositInfo[msg.sender].totalERC20Balance; //Formula for calculating points total return (((Math.sqrt(totalUserBalance) * lengthOfDeposit) / SCALE) * userMultiplier) / 100; } ```
In L219, the value of `totalUserBalance` is calculated by plusing the number of native tokens of `msg.sender` and the number of erc20 tokens that `msg.sender` has deposited into the current contract. It is weird to plus different asset's balances from a different account. Since the value is just used to emit events, we couldn't understand this variable quite well. ```solidity=218 function transferFunds(uint256 _identifier) internal returns (uint256) { uint256 totalUserBalance = msg.sender.balance + depositInfo[msg.sender].totalERC20Balance; ```
The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (1)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us