Haven1 - Permission Manager

CertiKFiles named in the report

CertiK reviewed Haven1 (Haven1 - Permission Manager) on 4 Mar 2025: 22 findings, 4 critical; 16 marked fixed, 6 open.

4 critical findings, fixed
Open the reportOpen Haven1’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings22

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical004
High001
Medium002
Low609
LowInvalid Use of Access Control ModifierOpen

The functions marked as `view` or `pure` are unnecessarily restricted by the `onlyImplementation` modifier. These functions are designed to be read-only, meaning they do not modify the state of the blockchain. However, they are restricted so only a specific address can call them. It's important to note that even private state variables can be read off-chain, rendering the access restriction on these functions ineffective.

LowRedundant Outer Mapping in `votingStatus` ResultsOpen

The issue arises because the votingStatus mapping within the OrgVoterDetails struct is defined as `mapping(uint256 => mapping(address => bool))`, but everywhere in the code it is accessed using `orgVoterList[id].votingStatus[id]`. This effectively reduces the `mapping` to `mapping(address => bool)` for a single `id`, making the outer `uint256` key redundant. As a result, the current structure wastes storage and adds unnecessary complexity, since the outer mapping serves no functional purpose when it is always accessed with the same key.

LowSolidity Version Not RecommendedOpen

Using an outdated or incorrect version of the Solidity compiler can expose the contract to security vulnerabilities and compatibility issues. For example, specifying a version like `pragma solidity ^0.5.3`; restricts the contract to Solidity versions `0.5.3` or higher, but it does not account for important improvements, bug fixes, or security enhancements introduced in later versions. Moreover, this approach may prevent the contract from leveraging safer math operations, which were only introduced in Solidity `0.8.x` to prevent overflows and underflows. It is essential to specify a compiler version that is compatible with the latest stable releases to ensure the contract benefits from the latest features, security checks, and optimizations.

LowUncontrolled List Growth Leading to Gas Limit ExcOpen

Uncontrolled growth of a list (e.g., dynamic arrays or mappings) without implementing limits or clean-up, and you have a separate function that enumerates or processes all elements in the list, you may encounter a "gas limit exceeded" issue. This occurs because the gas required to iterate through the list grows proportionally with its size, eventually surpassing the block gas limit and making the enumeration function unusable as the list becomes too large.

LowUnused Fields in Internal StructsOpen

Defining an internal structure with fields that are never used leads to unnecessary complexity and wasted storage or memory allocation during contract execution. Unused fields in a struct increase the size of the struct and can result in inefficient use of resources, potentially increasing gas costs for operations involving the struct. Moreover, such fields can make the code harder to understand and maintain, as they may confuse developers or imply functionality that does not exist. This issue highlights the importance of reviewing and optimizing struct definitions to include only relevant fields.

LowUse of Magic Numbers Instead of ConstantsOpen

In Solidity, using magic numbers (hardcoded numeric values) instead of defined constants reduces code readability and maintainability. Magic numbers do not convey their purpose or meaning, making it difficult for developers to understand the intent of the code. Additionally, if the same value needs to be updated in multiple places, it increases the risk of errors and inconsistencies. Replacing magic numbers with properly named constants improves clarity, ensures consistency, and makes the code easier to maintain and modify.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (8)

  • contracts/VoterManager.sol
  • contracts/RoleManager.sol
  • contracts/PermissionsImplementation.sol
  • contracts/NodeManager.sol
  • contracts/PermissionsUpgradable.sol
  • contracts/AccountManager.sol
  • contracts/PermissionsInterface.sol
  • contracts/OrgManager.sol

Part of Haven1’s security record

Haven1
Audits2 audits by 1 firmLast audit Mar 2025, by CertiK.
Critical findingsNo open critical findingsAcross the 2 reports, 4 critical findings were reported. Each is marked fixed by the firm that reported it.
Open Haven1’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us