CertiK reviewed BakerySwap (Bakery Swap) on 17 Sep 2020: 32 findings, 0 critical; 20 marked fixed, 12 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm鈥檚 own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 12 | 0 | 20 |
The linked segments contain the unicode icon 馃 as a leftover from Uniswap.
We have taken note of an extensive test suite located in the repository, however we advise that fuzz-based testing is introduced to ensure that the values retrieved from the reward calculation follow the plot you have set within the calculations.
The linked mathematical statements are conducted in a different order than each other, with the former being a subtraction - multiplication - division and the latter being a subtraction - division (w/ subtraction rounding) - multiplication. In Solidity, the order of mathematical execution is important as there is no concept of a decimal number and divisions are rounded down.
The linked case ensures that `fromBulkNumber` is greater-than (>) the literal 0 before multiplying it with a value in the ternary operator after being subtracted by 1. Since the value is subtracted by 1, in the case that `fromBlockNumber` is 1 the multiplication would again yield 0.
The conditionals check whether the uint256 variables are less than the literal 1. This is only the case when the value is 0.
The linked statements conduct a greater-than (>) comparison between an unsigned integer and the value literal 0.
Each instruction on the EVM costs gas to execute and in this case, each member of the struct is independently written to instead of conducting a single mass-write by instantiating a `PoolInfo` declaration in `memory` and subsequently assigning it to `poolInfoMap[_pair]`.
The manual zeroing operations could instead be replaced by a delete operation on `poolUserInfoMap[_pair][msg.sender]` which is more readable and gas efficient.
The newly added boolean variable is meant to represent whether an entry to the new poolInfoMap mapping exists to prevent duplicate calls to the add function. While this functions as intended, it is possible to utilize the already-existent non-zero variable `lastRewardBlock` for this particular purpose.
The linked newly introduced assignment should utilize the already existent `_feeToSetter` variable in `memory` rather than retrieving the newly stored `feeToSetter` variable from `storage`, optimizing the gas cost involved in deploying the contract.
The linked variable declarations are only assigned to once during the constructor of the contract.
The linked variable is only assigned to once during its instantiation at the contract level.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (29)
1,044 projects reviewed 路 1,375 reports 路 latest May 2025
See CertiK鈥檚 auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us