Labrado - Audit

CertiKFiles named in the report

CertiK reviewed Labrado (Labrado - Audit) on 17 Oct 2022: 11 findings, 1 critical; 4 marked fixed, 1 acknowledged, 6 open.

1 critical finding, fixed
Open the reportOpen Labrado’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings11

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical001
High010
Medium000
Low603
LowDiscussion of the contract `LabradoOperator`Open

According to the codes in the contract `LabradoOperator`, the users can use the function `depositToken()` for the deposit of ERC20 tokens or native tokens, which transfers the tokens to the address `operatorWalletTokens` directly, and can use the function `depositNFT()` for the NFT deposit, which transfers the NFT to the address `operatorWalletNFTs` directly. These deposits are not recorded in the contract and there are no functions to withdraw the users' ERC20 tokens, native tokens, and NFTs.

LowDiscussion of the variables `openSwap` and `openAOpen

According to the protocol, the variables `openSwap` and `openAddLiquidity` are used to limit whether anyone can use the swap and add liquidity functions. These variables can be updated by the privileged roles. The `Labrado` is a decentralized crypto trading protocol and may be used by other contracts as a third-party dependency. When the two variables are false, some logic in the contracts depended on the swap and add liquidity functions may fail. For examples: 1. In Deflationary Tokens(like SafeMoon), accumulated transfer fees will be used to add liquidity in the call of transfer. In this condition, the add liquidity function is forbidden and the call of transfer will fail. 2. In some DeFi protocols, the contract may call the swap function to swap tokens to match their logic. In this condition, the swap function is forbidden and the logic in these contracts may fail to execute.

LowImproper Usage of `public` and `external` TypeOpen

`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.

LowLack of reasonable boundaryOpen

The function `setupFeeSwap()` is used to change the value of variable `feeSwap`, which is used to calculated the fee in swap. The variable `feeSwap` does not have a reasonable boundary, so it can be given up to 999 after deploying, which means the fee charged on swapping could be 99.9%.

LowUnlocked Compiler VersionOpen

The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to different compiler versions. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

LowUnused library `LabradoLiquidityMathLibrary`Open

The library is never used in the project.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (29)

  • contracts/Excalibur.sol
  • contracts/DEX/swap-core/LabradoFactory.sol
  • contracts/DEX/swap-core/interfaces/ILabradoCallee.sol
  • contracts/DEX/periphery/libraries/BitMath.sol
  • contracts/DEX/periphery/libraries/LabradoLiquidityMathLibrary.sol
  • contracts/LabradoOperator.sol
  • contracts/DEX/swap-core/interfaces/ILabradoLP.sol
  • contracts/DEX/periphery/interfaces/ILabradoRouter02.sol
  • contracts/DEX/swap-core/interfaces/ILabradoPair.sol
  • contracts/DEX/periphery/LabradoRouter02.sol
  • contracts/DEX/periphery/libraries/Babylonian.sol
  • contracts/DEX/periphery/libraries/SafeMath.sol
  • contracts/DEX/periphery/interfaces/ILabradoRouter01.sol
  • contracts/DEX/swap-core/libraries/Math.sol
  • contracts/DEX/swap-core/libraries/UQ112x112.sol
  • contracts/LabradoToken.sol
  • contracts/DEX/periphery/interfaces/IERC20.sol
  • contracts/DEX/periphery/libraries/LabradoOracleLibrary.sol
  • contracts/DEX/swap-core/LabradoPair.sol
  • contracts/DEX/periphery/libraries/LabradoLibrary.sol
  • contracts/DEX/swap-core/libraries/SafeMath.sol
  • contracts/LabradoBaseNFT.sol
  • contracts/DEX/periphery/libraries/FixedPoint.sol
  • contracts/DEX/periphery/libraries/TransferHelper.sol
  • contracts/DEX/periphery/interfaces/IWETH.sol
  • contracts/DEX/swap-core/interfaces/ILabradoFactory.sol
  • contracts/DEX/swap-core/interfaces/IERC20.sol
  • contracts/DEX/periphery/libraries/FullMath.sol
  • contracts/DEX/swap-core/LabradoLP.sol

Part of Labrado’s security record

Labrado
Audits1 audit by 1 firmLast audit Oct 2022, by CertiK.
Critical findingsNo open critical findingsIn that report, 1 critical finding was reported. It is marked fixed by the firm that reported it.
Open Labrado’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us