CertiK reviewed Rich Quack (Quackpad IDO + Inqubator) on 4 Jul 2023: 8 findings, 0 critical; 3 marked fixed, 5 acknowledged.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 4 | 3 |
The function `addLiquidity()` will add liquidity into the `paymentToken`-`saleToken` pair and record the actual added amount of `paymentToken`. It was noted that the contract uses **=** instead *+=* to store this value into variable `intermediate.usdToLiq`. According to the implementation of this function, it can be called more than once, and when this happens, the **=** operator will cause the overwriting of the old value of `intermediate.usdToLiq`.
In the `PresalePublicTest` contract, there is a missing check in the `invest()` function for the moon round sale that adjusts the tokens purchased if there are fewer tokens leftover that the user wants to buy. The following check is located in the diamond and paper rounds. ```solidity if (userPart > intermediate.tokensForSaleLeft) userPart = intermediate.tokensForSaleLeft; ``` The inclusion of this would help to make it easier for tokens to be handled in the case where all leftover tokens are purchased in the moon round of the sale.
Since the `raisedAmount` is a moving value that is constantly being updated by various functions in the contract, there can be minor rounding issues that would be present. Also, since there is never a direct check that the `hardcap` is never exceeded, having the following comparison in the `_isClosingAvailable()` function might result in the rare case where the presale contract cannot be closed. ```solidity function _isClosingAvailable(uint8 round) private view returns (bool) { if (round == 0) { uint256 tokenAmount; for (uint256 i; i < 10; i++) { tokenAmount += roundTokenAllocation[round][i]; } if (tokenAmount == 0) return true; } if ( intermediate.tokensForSaleLeft == 0 || intermediate.raisedAmount == generalInfo.hardCap // raisedAmount might exceed hardCap ) return true; else return false; } ```
The report names a repository or files. Open the report to see its scope.
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us