VIDT DAO

CertiK27 Sep 2022Code version: not recorded (see the report)

Audit

CertiK reviewed VIDT DAO on 27 Sep 2022: 14 findings, 0 critical; 8 marked fixed, 1 acknowledged, 5 open.

No open critical findings

Open the report Open VIDT DAO’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings14

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	3	0	0
Medium	0	1	1
Low	2	0	7

MediumThe same hash can validate twiceFixed

According to the logic, the index of `fileHashes` starts from 0, but the logic for detecting the presence of a hash is based on whether the index is 0 or not. This will result in the first hash being able to be verified twice.

LowLack of Input ValidationFixed

The parameter `Data` is not validated, however it's checked in the function `validateFile()`.

LowLoop OptimizationFixed

In the function `verifyFile()`, the loop that checks for byte inequality would be more efficient if it aborted the loop as soon as it found a match.

LowMissing Emit EventsFixed

The function `simpleValidateFile()` emits the event `Transfer`, but the function `covertValidateFile()` does not.

LowRedundant CodeFixed

The function `increaseAllowance()` has the same implementation logic as the function `increaseApproval()`, the function `decreaseAllowance()` has the same issue.

LowRedundant Modifier `payable`Fixed

The function that is declared `payable` can receive ether. The function `simpleValidateFile()` seems not designed for receiving ether, so it is redundant to have the `payable` modifier.

LowUsage of `transfer()` for sending EtherFixed

After [EIP-1884](https://eips.ethereum.org/EIPS/eip-1884) was included in the Istanbul hard fork, it is not recommended to use `.transfer()` or `.send()` for transferring ether as these functions have a hard-coded value for gas costs making them obsolete as they are forwarding a fixed amount of gas, specifically `2300`. This can cause issues in case the linked statements are meant to be able to transfer funds to other contracts instead of EOAs.

LowVariables That Could Be Declared as `constant`Fixed

The linked variables could be declared as `constant` since these state variables are never modified.