Etherice

CertiK7 Nov 2022Files named in the report

Audit

CertiK reviewed Etherice on 7 Nov 2022: 31 findings, 0 critical; 22 marked fixed, 9 open.

No open critical findings

Open the report Open Etherice’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings31

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	3	1
Medium	0	3
Low	6	18

HighLack of Validation `_duration` in `fillLoan()` FuFixed

The lack of `_duration` validation in the `fillLoan()` function allows to take a loan whose duration will be exceeded of `_stake.endDay`.

MediumA Participant Can Always Win the Lottery by CalliFixed

A Participant can always win the lottery by calling `doDailyUpdate()`. To do this, the participant must: 1. Wait until the end of the day; 2. Place the highest bet; 3. Call `doDailyUpdate()` before anyone makes a big bet.

MediumThe `_loan` value is not updated before the checkFixed

The `_loan` value is not updated before the check which causes the check of `_loan.filledBy` and `_loan.requestedBy` values to be incorrect.

MediumThe `calcTokenValue()` will not work if `currentDFixed

The `calcTokenValue()` will not work if `currentDay` is not updated.

LowComment is inconsistent with codeFixed

The event `BiggestBuyCompWinner` is emitted from `EthericeBiggestBuyFlat.sol`.

LowCommented Out CodeFixed

Commented out code is redundant.

LowDeclaration Naming ConventionFixed

Internal and private function names don't start with "_".

LowDivide Before MultiplyFixed

Performing integer division before multiplication truncates the low bits, losing the precision of calculation. ```solidity=897 uint256 _marketingTax = (_amount / _totalTax) * marketing_percentage; ``` --- ```solidity=898 uint256 _rewardsTax = (_amount / _totalTax) * rewards_percentage; ``` --- ```solidity=899 uint256 _buybackTax = (_amount / _totalTax) * buyback_percentage; ``` --- ```solidity=900 uint256 _buyCompTax = (biggestBuy_percent > 0) ? (_amount / _totalTax) * biggestBuy_percent : 0; ```

LowFee Denominator Should Be Declared as ConstantFixed

The magic number `1000` is used as fee denominator across different contracts.

LowFunction Should Be Declared ExternalFixed

The functions which are never called internally within the contract should have external visibility for gas optimization.

Show 10 more

LowInconsistency in the description in the `StakeSolFixed

In the event `StakeSold` one of the fields is `price` but when filling the event in the function `buyStake()` use `_sellAmount`.

LowLack of `mapStakes[_stakeId].forSalePrice` ValidaFixed

The `cancelStakeSellRequest()` function does not check that the value of `mapStakes[_stakeId].forSalePrice` is not zero, so it will emit event `CancelStakeSellRequest` even though there was no request.

LowMissing Error MessagesFixed

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

LowMissing Zero Address ValidationFixed

Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=793 _stakingContract = _stakingCa; ``` - `_stakingCa` is not zero-checked before being used. ```solidity=333 _tokenContract = TokenContractInterface(_address); ``` - `_address` is not zero-checked before being used. ```solidity=240 _tokenContract = EthericeTokenInterface(_tokenAddress); ``` - `_tokenAddress` is not zero-checked before being used.

LowPotential Reentrancy AttackFixed

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects.

LowThe `_val` naming is not informativeFixed

The `_val` naming is not informative.

LowThe `TODO` CommentFixed

The aforementioned line has a TODO comment. It looks like there is uncompleted function according to the comment. If not, consider removing the redundant TODO comment. A good practice is that there is not TODO comment in product codes.

LowTypo in Name `dayDivendPool`Fixed

There is a typo in name `dayDivendPool`. Expected `dayDividendPool`.

LowUnlocked Compiler VersionFixed

The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

LowUsage of `memory` Variable Over `storage`Fixed

The whole structure will be retrieved from storage to memory yet only one field is needed.

Show 2 more

LowUsage of `transfer`/`send` for sending EtherFixed

It is not recommended to use Solidity's `transfer()` and `send()` functions for transferring Ether, since some contracts may not be able to receive the funds. Those functions forward only a fixed amount of gas (2300 specifically) and the receiving contracts may run out of gas before finishing the transfer. Also, EVM instructions' gas costs may increase in the future. Thus, some contracts that can receive now may stop working in the future due to the gas limitation.

LowUsage of Magic NumberFixed

The `fillLoan()` function uses the magic number `98` as development fees. The `buyStake()` function uses the magic number `90` as development fees.