Messier - Audit

CertiK2 addresses on Ethereum

CertiK reviewed MESSIER (Messier - Audit) on 23 May 2023: 28 findings, 0 critical; 25 marked fixed, 3 acknowledged.

No open critical findings
Open the reportOpen MESSIER’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings28

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High012
Medium007
Low0216
HighCentralization Related RisksAcknowledged

In the contract `Dao` the role `ORACLE` in the address [0xe0cf9c69894e2cca7221a5d1db2f867ece64b08c](https://etherscan.io/address/0xe0cf9c69894e2cca7221a5d1db2f867ece64b08c) has authority over the functions below. - function `CloseProposal`: to change a proposal's state to `FAILED`. - function `OracleNext`: to validate the quantity of affirmative and negative votes, as well as the number of singers, associated with a proposal before transitioning to the voting phases. Upon the successful completion of these evaluations, the state of the proposal would be modified to initiate the voting stages. - function `FullCycleToExecution`: to execute a cycle, calculate and process the rewards. In the contract `Dao` the role `ORACLE` in the commit [be0fb877ce73207ea4906a438b4390429ef5c953](https://github.com/MessierM87/VIRGO_SolidityContracts/tree/be0fb877ce73207ea4906a438b4390429ef5c953/contracts) has authority over the functions below. - function `OracleNext`: to execute a proposal if the proposal's state is `ready`. - function `FullCycleToExecution`: to execute a cycle, calculate and process the rewards. - function `changeState`: to change the state for a proposal regarding the current state and votes. Any compromise to the `ORACLE` account may allow the hacker to take advantage of this authority. In the contract `Dao` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority, and set the `_SupernovaBridge` and `_supernova`. ![](https://accelerator-tasks-prod.acc.corp.certik.com/4fb3912d16c54542bb881998b2376e0d/diagrams/centralization_Dao-Dao-_owner.svg) In the contract `Dao` the role `Halo` has authority over the functions below. - function `VoteOnProposal()`: to vote for a proposal. Any compromise to the `Halo` account may allow the hacker to take advantage of this authority. In the contract `Dao` the role `Powehi` has authority over the functions below. - function `createCashOutProposal()`: to create a new cash-out proposal. - function `createDoubleClassicProposal()`: to create a new double down or classical proposal. - function `createStructureProposal()`: to create a new structural proposal. - function `signOnProposal()`: to sign a proposal. Any compromise to the `Powehi` account may allow the hacker to take advantage of this authority.

LowThe design of `execute_oneProposal()` and `executAcknowledged

The `execute_Cycle()` and `execute_oneProposal()` functions exhibit significant interactions with the `_SupernovaBridge` contract, which falls outside the scope of this audit. Therefore, we would like the team to provide further elaboration on the design of these functions.

LowUnsafe Integer CastAcknowledged

```solidity=330 uint8 signersNum = uint8(proposal.signers.length); ``` - The type conversion `uint8(proposal.signers.length)` from larger type uint256 to smaller type uint8 may truncate data. --- ```solidity=517 uint8 signersNum = uint8(proposal.signers.length); ``` - The type conversion `uint8(proposal.signers.length)` from larger type uint256 to smaller type uint8 may truncate data.

Contracts in scope2

AddressChainSource code
0xe0cf9c69894e2cca7221a5d1db2f867ece64b08cChain: EthereumSource code: Verified source
0x2b653f343e11ded7daef015aa3034594c3194dd4Chain: EthereumSource code: Verified source

Part of MESSIER’s security record

MESSIER
Audits4 audits by 3 firmsLast audit Aug 2023, by HashEx.
Critical findingsNo open critical findingsAcross 4 reports.
Open MESSIER’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us