CertiK reviewed MESSIER (Messier - Audit) on 23 May 2023: 28 findings, 0 critical; 25 marked fixed, 3 acknowledged.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 2 |
| Medium | 0 | 0 | 7 |
| Low | 0 | 2 | 16 |
In the contract `Dao` the role `ORACLE` in the address [0xe0cf9c69894e2cca7221a5d1db2f867ece64b08c](https://etherscan.io/address/0xe0cf9c69894e2cca7221a5d1db2f867ece64b08c) has authority over the functions below. - function `CloseProposal`: to change a proposal's state to `FAILED`. - function `OracleNext`: to validate the quantity of affirmative and negative votes, as well as the number of singers, associated with a proposal before transitioning to the voting phases. Upon the successful completion of these evaluations, the state of the proposal would be modified to initiate the voting stages. - function `FullCycleToExecution`: to execute a cycle, calculate and process the rewards. In the contract `Dao` the role `ORACLE` in the commit [be0fb877ce73207ea4906a438b4390429ef5c953](https://github.com/MessierM87/VIRGO_SolidityContracts/tree/be0fb877ce73207ea4906a438b4390429ef5c953/contracts) has authority over the functions below. - function `OracleNext`: to execute a proposal if the proposal's state is `ready`. - function `FullCycleToExecution`: to execute a cycle, calculate and process the rewards. - function `changeState`: to change the state for a proposal regarding the current state and votes. Any compromise to the `ORACLE` account may allow the hacker to take advantage of this authority. In the contract `Dao` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority, and set the `_SupernovaBridge` and `_supernova`.  In the contract `Dao` the role `Halo` has authority over the functions below. - function `VoteOnProposal()`: to vote for a proposal. Any compromise to the `Halo` account may allow the hacker to take advantage of this authority. In the contract `Dao` the role `Powehi` has authority over the functions below. - function `createCashOutProposal()`: to create a new cash-out proposal. - function `createDoubleClassicProposal()`: to create a new double down or classical proposal. - function `createStructureProposal()`: to create a new structural proposal. - function `signOnProposal()`: to sign a proposal. Any compromise to the `Powehi` account may allow the hacker to take advantage of this authority.
The `execute_Cycle()` and `execute_oneProposal()` functions exhibit significant interactions with the `_SupernovaBridge` contract, which falls outside the scope of this audit. Therefore, we would like the team to provide further elaboration on the design of these functions.
```solidity=330 uint8 signersNum = uint8(proposal.signers.length); ``` - The type conversion `uint8(proposal.signers.length)` from larger type uint256 to smaller type uint8 may truncate data. --- ```solidity=517 uint8 signersNum = uint8(proposal.signers.length); ``` - The type conversion `uint8(proposal.signers.length)` from larger type uint256 to smaller type uint8 may truncate data.
| Address | Chain | Source code |
|---|---|---|
| 0xe0cf…b08c0xe0cf9c69894e2cca7221a5d1db2f867ece64b08c | Chain: Ethereum | Source code: Verified source |
| 0x2b65…4dd40x2b653f343e11ded7daef015aa3034594c3194dd4 | Chain: Ethereum | Source code: Verified source |
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us