CertiK reviewed 1inch Network (1inch Mooniswap v2) on 16 Dec 2020: 36 findings, 0 critical; 27 marked fixed, 9 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 1 | 0 | 2 |
| Low | 8 | 0 | 25 |
The `src` and `dst` arguments of the `swapFor` function are not guaranteed to be equal to the supported tokens of the exchange. While `_doTransfers` will simply yield 0 for the `confirmed` variable on unsupported tokens, this can lead to incorrect reward minting on `_mintRewards` as the confirmed balance is simply utilized during reward calculation
The linked `require` statements could instead be coded in a small `internal` or `private` function that is invoked by a corresponding `modifier` to reduce the gas footprint of the contract.
The linked code block creates a new in-memory `bytes` array and assigns each byte sequentially to it via a loop from the `data` array
The linked Babylonian Square Root implementation can be further optimized by omitting the final `else` block as Solidity returns zeroed out values by default regardless of whether the return variable has been explicitly named or not. Additionally, we highly advise that the new, more optimized Babylonian Method from ABDK Consulting is evaluated as an optimized alternative which has already been integrated in Uniswap.
The linked functions are declared as `external` or `public`, contain array function arguments and are meant to be mostly invoked by external parties.
The linked code block contains four `for` loops to ultimately conduct all operations necessary on the 2-member `maxAmounts` and `realBalances` arrays.
The linked `require` statements ensure that the `maxAmounts` provided to the contract at the start are greater-than ( `>` ) zero, yet they are evaluated mid-way through.
The function `_toHex` is implemented twice utilizing function overloading, however the middleware implementation accepting an `address` argument is only used once.
The `vote` library is meant to be utilized on Data structs that contain only a single `uint256` value.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (23)
1,044 projects reviewed · 1,393 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us