CertiK reviewed 4. Ignore Fud (Ignore Fud Bridge) on 16 May 2023: 8 findings, 0 critical; 6 marked fixed, 1 acknowledged, 1 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 0 | 4 |
| Medium | 0 | 0 | 2 |
| Low | 0 | 1 | 0 |
The contract is serving as the underlying entity to interact with one or more third-party libraries and protocols, such as `LayerZero` and ERC-20 tokens. The scope of the audit treats third-party entities as black boxes and assumes their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, etc. Additionally, if the wrapped token is compromised (such as unlimited mint) on the destination chain, it can be used to drain original token on the source chain. ```solidity=1008 ILayerZeroEndpoint public immutable lzEndpoint; ``` - The contract `LzApp` interacts with third party contract with `ILayerZeroEndpoint` interface via `lzEndpoint`. --- ```solidity=1418 mapping(address => mapping(uint16 => address)) public remoteToLocal; ``` - The contract `WrappedTokenBridge` interacts with third party contract with `IWrappedERC20` interface via `remoteToLocal`. --- ```solidity=1455 function bridge(address localToken, uint16 remoteChainId, uint amount, address to, bool unwrapWeth, LzLib.CallParams calldata callParams, bytes memory adapterParams) external payable nonReentrant { ``` - The function `WrappedTokenBridge.bridge` interacts with third party contract with `IWrappedERC20` interface via `localToken`. ```solidity=1338 ILayerZeroEndpoint public immutable lzEndpoint; ``` - The contract `LzApp` interacts with third party contract with `ILayerZeroEndpoint` interface via `lzEndpoint`. --- ```solidity=1687 address public immutable weth; ``` - The contract `OriginalTokenBridge` interacts with third party contract with `IWETH` interface via `weth`. --- ```solidity=1722 function accruedFeeLD(address token) public view returns (uint) { ``` - The function `OriginalTokenBridge.accruedFeeLD` interacts with third party contract with `IERC20` interface via `token`. --- ```solidity=1734 function bridge(address token, uint amountLD, address to, LzLib.CallParams calldata callParams, bytes memory adapterParams) external payable nonReentrant { ``` - The function `OriginalTokenBridge.bridge` interacts with third party contract with `IERC20` interface via `token`. --- ```solidity=1787 (uint8 packetType, address token, address to, uint withdrawalAmountSD, uint totalAmountSD, bool unwrapWeth) = abi.decode(payload, (uint8, address, address, uint, uint, bool)); ``` - The function `OriginalTokenBridge._nonblockingLzReceive` interacts with third party contract with `IERC20` interface via `token`.
| Address | Chain | Source code |
|---|---|---|
| 0x04cb…4d7f0x04cbefb3d208172336f74448d529148b429d4d7f | Chain: BNB Chain | Source code: Verified source |
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us