CertiK reviewed Cheelee on 7 Feb 2023: 14 findings, 0 critical; 11 marked fixed, 3 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 3 | 0 | 0 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 0 | 10 |
The following values are critical to the contract vesting logic and should be validated to ensure they are set to values that do not disrupt contract logic. - beneficiary[_beneficiaryAddress].duration = _durationSeconds; - beneficiary[_beneficiaryAddress].cliff = _cliff; - beneficiary[_beneficiaryAddress].amount += _amount; For example, there should be a check ensuring that `_durationSeconds` > 0.
Boolean constants can be used directly and do not need to be compared to true or false. ```solidity=45 if (registeredUserMap[msg.sender] == false) { ``` --- ```solidity=117 require(usedSignature[_nonce] == false, "Signature already used"); ``` --- ```solidity=142 require(usedSignature[_nonce] == false, "Signature already used"); ```
Multiple Solidity versions are used in the codebase. Versions used: `^0.8.0`, `^0.8.4`, and `^0.8.13`
According to the OpenZeppelin library `draft-ERC20Permit.sol`, it is recommended to use the same `name` for the ERC20Permit declaration that is defined as the ERC20 token name.
Functions which are never called internally by the contract should have external visibility for gas optimization.
There should always be events emitted in the sensitive functions that are controlled by centralization roles.
Addresses should be checked before assignment or external call to make sure they are not zero addresses.
Literals with many digits are difficult to read and review. ```solidity=10 uint256 public constant MAX_AMOUNT = 1000000000 * 10**18; ``` --- ```solidity=8 uint256 public constant MAX_VALUE = 7000000000 * 10**18; ``` --- ```solidity=11 uint256[] public emission = [ 1750000000000000000000000000, 3150000000000000000000000000, 4550000000000000000000000000, 5600000000000000000000000000, 6300000000000000000000000000, MAX_VALUE ]; ```
In the contract `LEE.sol`, there are two typographical errors to be changed. 1. "CHEELEE" is misspelled in the constructor on line 25 2. Grammatical error in the error message on line 32, which should be changed to the following: ```solidity=32 "Can't mint more than max amount" ``` ---- In the contracts `IVesting.sol` and `MultiVesting.sol`, the function `emergancyVest()` is misspelled and should be changed to the following: ```solidity function emergencyVest() external; ```
The return value of the `transfer()`/`transferFrom()` call is not checked.
The use of the unit **ether** for the uint arrays `minAmount` and `maxAmount` can be misleading and cause confusion, as the amounts are referring to tokens and not **Ether**, the native cryptocurrency for the Ethereum blockchain.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (10)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us