Logium

CertiK16 Sep 2022Files named in the report

CertiK reviewed Logium on 16 Sep 2022: 26 findings, 0 critical; 4 marked fixed, 1 acknowledged, 21 open.

No open critical findings

Open the report Open Logium’s security record

Report hosted on skynet.certik.com.

Statuses are the security firm’s own, from this report. Trustblock does not review code.

Findings26

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	1	1
Medium	0	0	0
Low	21	0	3

HighUsers Cannot Exercise on `claim()`, `exercise()`,Fixed

Because contracts are unverified, this leaves the user to trust the automated bots to execute the bet. The betImplementation is also unverified on chain, so the user has no way to figure out how to do this at all.

LowTests Fail To RunFixed

When running the tests via `npx hardhat test`, an error occurs: ```typescript test/flashLoan.spec.ts:181:11 - error TS2345: Argument of type '{ maker: SignerWithAddress; isUp: boolean; poolObj: IUniswapV3 Pool; strikeUniswapTick: number; volume: BigNumber; period: number; ratio: number; ... 8 more ...; chainId: number; }' is not assignable to parameter of type 'TicketConstructorParams'. Object literal may only specify known properties, and 'coreAddress' does not exist in type 'TicketConstructorParams'. 181 coreAddress: core.contract.address, ```

LowUnexplained Comment LineFixed

The comment above the interface `ILogiumBinaryBetState` reads "Explain to an end user what this does". It does not reflect the intention or purpose of the interface.

LowUser Cannot Execute TradeFixed

Because betImplemenation is unverified, the user cannot ever call the main contract to execute the strike. If the contract is not executed instantly, then each side could have a chance to win.