CertiK reviewed Kindly (Kindly Coin) on 9 Sep 2022: 12 findings, 1 critical; 10 marked fixed, 2 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 2 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 0 | 9 |
When `withdraw()` is called via `executeMetaTransaction()` the result of the _msgSender() function is the contract address `Kindly` so the tokens will not be burned from the `userAddress` address, but from the contract address `Kindly`. The same behavior can be in other functions using `_msgSender()`.
Internal functions doesn't start with "_". - `toTypedMessageHash()` - `hashMetaTransaction()` - `verify()`
`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.
The function that affects the status of sensitive variables should be able to emit events as notifications to customers: - `mint()` - `deposit()`
The linked statements do not affect the functionality of the codebase and appear to be either leftovers from test code or older functionality.
Literals with many digits are difficult to read and review. ```solidity=262 _mint(_msgSender(), 108000000 * 10**18); ```
There is a typo in the comment: `contractsa` should be `contracts` There is a typo in the `Initializable.sol`: `inited` should be `initialized`
The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.
The `SafeMath` library is used unnecessarily. With Solidity compiler versions 0.8.0 or newer, arithmetic operations will automatically revert in case of integer overflow or underflow.
```solidity=51 struct EIP712Domain { string name; string version; address verifyingContract; bytes32 salt; } ``` - `EIP712Domain` is declared but never used.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (2)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us