Chiliz Chain

Resonance SecurityCode version: not recorded (see the report)

Audit · firm’s term: audit report

Resonance Security reviewed Chiliz (Chiliz Chain) on 20 Aug 2025: 6 findings, 0 critical; 5 marked fixed, 1 acknowledged.

No open critical findings
Open the reportOpen Chiliz’s security record
Report stored on IPFS. Content hash QmeStSagkKWN6iarSnhSzD2rTjebwwygT8fhETVn4YB8Uh

Trustblock does not review code.

Findings14

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High010
Medium002
Low003

Marked Info by the firm. Not counted as findings.

Info_swapWithBurnAndMint Allows 0 Amount SwapsFixed

The function does not check if oldFTAmount is zero. This could allow zero-amount swaps, which may cause unnecessary events and state changes.

InfoFloating PragmaFixed

The project uses floating pragmas ^0.8.23.This may result in the contracts being deployed using the wrong pragma version, which is different from the one they were tested with. For example, they might be deployed using an outdated pragma version which may include bugs that affect the system negatively.

InfoIncorrect Initialization Order On initialize()Fixed

According to best practices, the inherited smart contracts should be initialized according to their inheritance order, from the most base-like to the most derived.

InfoMissing Reentrancy Guard Modifier On swapStakedTokens() And swapStaked()Fixed

The swapStakedTokens() function unstakes, claims, swap tokens transfers them back from user to stake the new token. The swapStaked() function calls burn and mint functions in _swapWithBurnAndMint(). As these functions transfer tokens to user and call external contracts, it is important to use the nonReentrant modifier in the same way as in the rest of the protocol.

InfoMixed Usage Of Initializing Functions In initialize()Fixed

The initialize() function in the Staking3 contract uses both internal and external functions to set roles grantRole() and _grantRole(). Using both works, but is not necessary. Using only _grantRole is simpler and more efficient for setup, as it is possible to avoid unnecessary access checks during initialization.

InfonewFTAmount Is Not EmittedFixed

The Swapped event in _swapWithBurnAndMint() fucntion does not include newFTAmount. This may affect potential off-chain accounting.

InfoTest Cases Not Working ProperlyFixed

The ERC20BurnableMintable contract located in the Staking3.t.sol does not implement the burn() function. The tests that use this function will not work properly.

InfoUnnecessary Initialization Of Variables With Default ValuesFixed

In the Solidity programming language, all variables are automatically initialized to a default value corresponding to their type when they are declared. For example, integer types are initialized to 0, boolean types to false, and address types to 0x0000000000000000000000000000000000000000. Explicitly initializing variables to these default values when they are declared is therefore redundant, and since each operation in a contract costs gas, it results in unnecessary gas costs. This could potentially impact the contract's efficiency and the cost of executing its functions.Several instances of this issue are found across the code base.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of Chiliz’s security record

Chiliz
Audits8 audits by 3 firmsLast audit Jan 2026, by Halborn.
Critical findingsNo open critical findingsAcross the 8 reports, 1 critical finding was reported. It is marked fixed by the firm that reported it.
Open Chiliz’s security record

Security firm

Resonance Security

26 projects reviewed · 34 reports · latest Dec 2025

See Resonance Security’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us