MeldDAO

CertiK9 Jun 2023Files named in the report

Audit

CertiK reviewed MELD (MeldDAO) on 9 Jun 2023: 15 findings, 0 critical; 9 marked fixed, 2 acknowledged, 4 open.

No open critical findings

Open the report Open MELD’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings15

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	1	0
Medium	0	1	2
Low	4	0	7

LowLack of reasonable boundaryOpen

There are no reasonable boundaries for the variable `redemptionFee`. It is possible to set the total fee rate up to any arbitrary amount.

LowUnsafe Integer CastOpen

--- ```solidity=116 return (flags >> uint8(flag)) % 2 == 1; ``` - The type conversion `uint8(flag)` from larger type uint256 to smaller type uint8 may truncate data.

LowUser-Defined GettersOpen

The linked functions are equivalent to the compiler-generated getter functions for the respective variables. For example: `DaoRegistry.getConfiguration()`, `DaoRegistry.getAddressConfiguration()`, `MeldVotingContract.getAdapterName()`.

LowVariables That Could Be Declared as ImmutableOpen

The linked variable `identityAddress` assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.