ErcProtocol

CertiKFiles named in the report

CertiK reviewed ErcProtocol on 16 Jun 2023: 9 findings, 0 critical; 6 marked fixed, 3 open.

No open critical findings
Open the reportOpen ErcProtocol’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings9

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High100
Medium000
Low206
LowDeclaration Naming ConventionFixed

One or more declarations do not conform to the [Solidity style guide](https://solidity.readthedocs.io/en/v0.7.3/style-guide.html#naming-conventions) with regards to its naming convention. Particularly: - `camelCase`: Should be applied to function names, argument names, local and state variable names, modifiers - `UPPER_CASE`: Should be applied to `constant` variables - `CapWords`: Should be applied to contract names, struct names, event names and enums ```solidity=40 uint32 public constant minimumTimeBetweenMints = 1 days * 365; ``` - Constant variable `minimumTimeBetweenMints` is not in `UPPER_CASE`. --- ```solidity=43 uint8 public constant mintCap = 2; ``` - Constant variable `mintCap` is not in `UPPER_CASE`. --- ```solidity=135 function _initialize(address timelock_) public { ``` - Function `_initialize` is not in `camelCase`. --- ```solidity=313 function GRACE_PERIOD() external view returns (uint); ``` - Function `GRACE_PERIOD` is not in `camelCase`.

LowLack of input validationFixed

The function should check if the transaction is already canceled. Otherwise, the transaction can be canceled many times and the event can be generated many times.

LowMissing Zero Address ValidationFixed

Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=84 minter = minter_; ``` - `minter_` is not zero-checked before being used. --- ```solidity=96 minter = minter_; ``` - `minter_` is not zero-checked before being used. --- ```solidity=132 guardian = guardian_; ``` - `guardian_` is not zero-checked before being used. --- ```solidity=37 target = target_; ``` - `target_` is not zero-checked before being used. --- ```solidity=31 admin = admin_; ``` - `admin_` is not zero-checked before being used. --- ```solidity=56 pendingAdmin = pendingAdmin_; ``` - `pendingAdmin_` is not zero-checked before being used. --- ```solidity=100 (bool success, bytes memory returnData) = target.call{value: value}(callData); ``` - `target` is not zero-checked before being used.

LowSusceptible to Signature MalleabilityFixed

The signature malleability is possible within the Elliptic Curve cryptographic system. An Elliptic Curve is symmetric on the X-axis, meaning two points can exist with the same `X` value. In the `r`, `s`, and `v` representation this permits us to carefully adjust `s` to produce a second valid signature for the same `r`, thus breaking the assumption that a signature cannot be replayed in what is known as a replay-attack.

LowUnchecked ERC-20 `transfer()`/`transferFrom()` CaFixed

The return value of the transfer()/transferFrom() call is not checked. ```solidity=64 token_.transfer(target_, toDrip_); ```

LowUnnecessary Use of SafeMathFixed

The `SafeMath` library is used unnecessarily. With Solidity compiler versions 0.8.0 or newer, arithmetic operations will automatically revert in case of integer overflow or underflow.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (4)

  • src/Reservoir.sol
  • src/GovernorAlpha.sol
  • src/EP.sol
  • src/Timelock.sol

Part of ErcProtocol’s security record

ErcProtocol
Audits1 audit by 1 firmLast audit Jun 2023, by CertiK.
Critical findingsNo open critical findingsIn 1 report.
Open ErcProtocol’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us