CertiK reviewed Haven1 (Haven1 - Permission Manager) on 4 Mar 2025: 22 findings, 4 critical; 16 marked fixed, 6 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 4 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 2 |
| Low | 6 | 0 | 9 |
The functions marked as `view` or `pure` are unnecessarily restricted by the `onlyImplementation` modifier. These functions are designed to be read-only, meaning they do not modify the state of the blockchain. However, they are restricted so only a specific address can call them. It's important to note that even private state variables can be read off-chain, rendering the access restriction on these functions ineffective.
The issue arises because the votingStatus mapping within the OrgVoterDetails struct is defined as `mapping(uint256 => mapping(address => bool))`, but everywhere in the code it is accessed using `orgVoterList[id].votingStatus[id]`. This effectively reduces the `mapping` to `mapping(address => bool)` for a single `id`, making the outer `uint256` key redundant. As a result, the current structure wastes storage and adds unnecessary complexity, since the outer mapping serves no functional purpose when it is always accessed with the same key.
Using an outdated or incorrect version of the Solidity compiler can expose the contract to security vulnerabilities and compatibility issues. For example, specifying a version like `pragma solidity ^0.5.3`; restricts the contract to Solidity versions `0.5.3` or higher, but it does not account for important improvements, bug fixes, or security enhancements introduced in later versions. Moreover, this approach may prevent the contract from leveraging safer math operations, which were only introduced in Solidity `0.8.x` to prevent overflows and underflows. It is essential to specify a compiler version that is compatible with the latest stable releases to ensure the contract benefits from the latest features, security checks, and optimizations.
Uncontrolled growth of a list (e.g., dynamic arrays or mappings) without implementing limits or clean-up, and you have a separate function that enumerates or processes all elements in the list, you may encounter a "gas limit exceeded" issue. This occurs because the gas required to iterate through the list grows proportionally with its size, eventually surpassing the block gas limit and making the enumeration function unusable as the list becomes too large.
Defining an internal structure with fields that are never used leads to unnecessary complexity and wasted storage or memory allocation during contract execution. Unused fields in a struct increase the size of the struct and can result in inefficient use of resources, potentially increasing gas costs for operations involving the struct. Moreover, such fields can make the code harder to understand and maintain, as they may confuse developers or imply functionality that does not exist. This issue highlights the importance of reviewing and optimizing struct definitions to include only relevant fields.
In Solidity, using magic numbers (hardcoded numeric values) instead of defined constants reduces code readability and maintainability. Magic numbers do not convey their purpose or meaning, making it difficult for developers to understand the intent of the code. Additionally, if the same value needs to be updated in multiple places, it increases the risk of errors and inconsistencies. Replacing magic numbers with properly named constants improves clarity, ensures consistency, and makes the code easier to maintain and modify.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (8)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us