CertiK reviewed BitDCA on 19 Feb 2025: 6 findings, 0 critical; 3 marked fixed, 3 acknowledged.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 2 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 1 | 3 |
In the linked locations, events are emitted after external calls. This does not adhere to the Check-Effects-Interactions Pattern, which recommends emitting events before making external calls as a best practice.
If an event is not indexed in a smart contract, it means that the event's parameters are not tagged with the `indexed` keyword. This has implications for how the event data can be searched and filtered when looking through blockchain logs. Without indexing, the event will still emit the data as part of the transaction log, but users won't be able to query for these events using the parameters. They'll have to retrieve the entire set of logs and manually sift through them to find events with the specific data. This can be less efficient and more time-consuming, especially on a blockchain with a high volume of transactions and events.
The function `BDCAVestingCEX.setVesting()` requires that the vesting process has not yet started. However, the `BDCAVestingCEX.startVesting()` function can be called before `BDCAVestingCEX.setVesting()` is executed. This creates a situation where `BDCAVestingCEX.setVesting()` becomes uncallable, effectively leaving the vault without any allocation settings. As a result, the contract may become non-functional.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (3)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us