Bancor Liquidity

CertiK9 Oct 2020Files named in the report

Audit

CertiK reviewed Bancor (Bancor Liquidity) on 9 Oct 2020: 17 findings, 0 critical; 6 marked fixed, 11 open.

No open critical findings

Open the report Open Bancor’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings17

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	0	0
Medium	0	0
Low	11	6

LowIncorrect version of solidityFixed

The linked contracts necessitate a version too recent to be trusted. Consider deploying with 0.6.11. We do not recommend using any latest version for deployment, especially if any changes were made in the optimizer or the language semantic. Version 0.6.12 made changes to optimizer that's why we do not recommend using this version.

LowLocal variable shadowingFixed

`address owner = liquidity.owner;` shadows `owner` variable from `Owned.sol` which is public one and contract inherits from it.

LowUnefficient ReentrancyGuard implementation.Fixed

ReentrancyGuards.sol implementation is un-optimal as booleans are more expensive than uint256 or any type that takes up a full word because each write operation emits an extra SLOAD to first read the slot's contents, replace the bits taken up by the boolean, and then write back.

LowUsage of literals instead of constant variablesFixed

Literals with many digits are difficult to read and are hard to maintain in terms of code changes.

LowUse of safemath is required in arithmetic operatFixed

SafeMath is not used on arithmetic operations. This can lead to potential overflow/underflow. `LiquidityPoolV1Converter.sol` and `LiquidityProtection.sol` does many math operations on uint256 but is not using SafeMath.

LowVariable from function param used on it's ownFixed

`_version` variable from param is used on its own.