Etherice

CertiK7 Nov 2022Files named in the report

Audit

CertiK reviewed Etherice on 7 Nov 2022: 31 findings, 0 critical; 22 marked fixed, 9 open.

No open critical findings

Open the report Open Etherice’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings31

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	3	1
Medium	0	3
Low	6	18

HighCentralization Risks in EthericeBiggestBuyFlat.soOpen

In the contract `EthericeBiggestBuy` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and change the percentages, exclude participants from the lottery, as well as start the lottery. ![](https://accelerator-tasks-prod.acc.corp.certik.com/72f3bfed492f461f9307a05e6ddbc72f/diagrams/centralization_EthericeBiggestBuyFlat-EthericeBiggestBuy-_owner.svg)

HighCentralization Risks in EthericeStakingFlat.solOpen

In the contract `EthericeStaking` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority to change the stacking parameters. ![](https://accelerator-tasks-prod.acc.corp.certik.com/72f3bfed492f461f9307a05e6ddbc72f/diagrams/centralization_EthericeStakingFlat-EthericeStaking-_owner.svg)

HighCentralization Risks in EthericeTokenFlat.solOpen

In the contract `EthericeToken` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and change token distribution parameters, update bonus and fee percentages, and change reward addresses. ![](https://accelerator-tasks-prod.acc.corp.certik.com/72f3bfed492f461f9307a05e6ddbc72f/diagrams/centralization_EthericeTokenFlat-EthericeToken-_owner.svg)

Low`_userStakes[]` is not removed when sellingOpen

`_userStakes[]` is always only added but nowhere removed, for example when selling the stake.

Low`mapUserAuctionEntry[_address][_Day].day` AlwaysOpen

`mapUserAuctionEntry[_address][_Day].day` always equal `_Day`.

LowBetter use an interface instead of `encodeWithSigOpen

For better code readability, it is recommended to define an interface and use it when calling a third-party contract instead of `abi.encodeWithSignature()`.

LowIncorrect calculation in `totalDivendPool()`Open

The value of `_total` after exiting the loop will be counted incorrectly due to `_startDay + i`.

LowPull-over-Push Pattern in `processWin()` FunctioOpen

The change of `topBuyTodayAddress` by function `newBuy()` overrides the previously set `topBuyTodayAddress` with the new one without guaranteeing the new `topBuyTodayAddress` is able to receive ETH.

LowTypo in CommentsOpen

List of typos in comments: - `Set the new top amount amount for the next lottery`, expected `Set the new top amount for the next lottery`; - `chance for other`, expected `chance for others`; - `winnner`, expected `winner`; - `Some address`, expected `Some addresses`; - `processesing`, expected `processing`; - `agaign`, expected `again`; - `availbe`, expected `available`; - `taxs`, expected `taxes`; - `fisr`, expected `first`; - `Calcualte`, expected `Calculate`.