Audit · firm’s term: audit report
Resonance Security reviewed Chiliz (Chiliz Chain) on 20 Aug 2025: 6 findings, 0 critical; 5 marked fixed, 1 acknowledged.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 0 |
| Medium | 0 | 0 | 2 |
| Low | 0 | 0 | 3 |
Marked Info by the firm. Not counted as findings.
The function does not check if oldFTAmount is zero. This could allow zero-amount swaps, which may cause unnecessary events and state changes.
The project uses floating pragmas ^0.8.23.This may result in the contracts being deployed using the wrong pragma version, which is different from the one they were tested with. For example, they might be deployed using an outdated pragma version which may include bugs that affect the system negatively.
According to best practices, the inherited smart contracts should be initialized according to their inheritance order, from the most base-like to the most derived.
The swapStakedTokens() function unstakes, claims, swap tokens transfers them back from user to stake the new token. The swapStaked() function calls burn and mint functions in _swapWithBurnAndMint(). As these functions transfer tokens to user and call external contracts, it is important to use the nonReentrant modifier in the same way as in the rest of the protocol.
The initialize() function in the Staking3 contract uses both internal and external functions to set roles grantRole() and _grantRole(). Using both works, but is not necessary. Using only _grantRole is simpler and more efficient for setup, as it is possible to avoid unnecessary access checks during initialization.
The Swapped event in _swapWithBurnAndMint() fucntion does not include newFTAmount. This may affect potential off-chain accounting.
The ERC20BurnableMintable contract located in the Staking3.t.sol does not implement the burn() function. The tests that use this function will not work properly.
In the Solidity programming language, all variables are automatically initialized to a default value corresponding to their type when they are declared. For example, integer types are initialized to 0, boolean types to false, and address types to 0x0000000000000000000000000000000000000000. Explicitly initializing variables to these default values when they are declared is therefore redundant, and since each operation in a contract costs gas, it results in unnecessary gas costs. This could potentially impact the contract's efficiency and the cost of executing its functions.Several instances of this issue are found across the code base.
The report names a repository or files. Open the report to see its scope.
26 projects reviewed · 34 reports · latest Dec 2025
See Resonance Security’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us