CertiK reviewed Labrado (Labrado - Audit) on 17 Oct 2022: 11 findings, 1 critical; 4 marked fixed, 1 acknowledged, 6 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 1 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 6 | 0 | 3 |
According to the codes in the contract `LabradoOperator`, the users can use the function `depositToken()` for the deposit of ERC20 tokens or native tokens, which transfers the tokens to the address `operatorWalletTokens` directly, and can use the function `depositNFT()` for the NFT deposit, which transfers the NFT to the address `operatorWalletNFTs` directly. These deposits are not recorded in the contract and there are no functions to withdraw the users' ERC20 tokens, native tokens, and NFTs.
According to the protocol, the variables `openSwap` and `openAddLiquidity` are used to limit whether anyone can use the swap and add liquidity functions. These variables can be updated by the privileged roles. The `Labrado` is a decentralized crypto trading protocol and may be used by other contracts as a third-party dependency. When the two variables are false, some logic in the contracts depended on the swap and add liquidity functions may fail. For examples: 1. In Deflationary Tokens(like SafeMoon), accumulated transfer fees will be used to add liquidity in the call of transfer. In this condition, the add liquidity function is forbidden and the call of transfer will fail. 2. In some DeFi protocols, the contract may call the swap function to swap tokens to match their logic. In this condition, the swap function is forbidden and the logic in these contracts may fail to execute.
`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.
The function `setupFeeSwap()` is used to change the value of variable `feeSwap`, which is used to calculated the fee in swap. The variable `feeSwap` does not have a reasonable boundary, so it can be given up to 999 after deploying, which means the fee charged on swapping could be 99.9%.
The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to different compiler versions. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.
The library is never used in the project.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (29)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us