PartyFinance

CertiK29 Mar 2022Files named in the report

Audit

CertiK reviewed PartyFinance on 29 Mar 2022: 7 findings, 0 critical; 4 marked fixed, 3 acknowledged.

No open critical findings

Open the report Open PartyFinance’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings7

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	0	0
High	2	1
Medium	0	0
Low	1	3

HighCentralization Related Risks in `PartyFactory`Acknowledged

In the contract `PartyFactory`, the role `owner` has authority over the following functions: - `setPlatformAddress()` - `setPlatformFee()` Any compromise to the `owner` account may allow a hacker to take advantage of this authority and arbitrarily change the platform address and fee rate before initializating the `Party` contract.

HighCentralization Related Risks in Contract `Party`Acknowledged

In the contract `Party`, the role `owner` has authority over the following functions: - `swapToken()` - `kickMember()` - `closeParty()` - `handleRequest()` - `createPost()` - `editPost()` - `deletePost()` Any compromise to the `owner` account may allow a hacker to take advantage of this authority and manipulate important party settings.

LowThird Party Dependencies on `0xSwap`Acknowledged

The contract is serving as the underlying entity to interact with third party `0xSwap` protocols. The scope of the audit treats 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.