Uplift.

CertiKFiles named in the report

CertiK reviewed Uplift (Uplift.) on 7 Oct 2022: 8 findings, 0 critical; 4 marked fixed, 2 acknowledged, 2 open.

No open critical findings
Open the reportOpen Uplift’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings8

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High200
Medium001
Low023
MediumIncompatibility With Deflationary TokensFixed

When transferring standard ERC20 deflationary tokens, the input amount may not be equal to the received amount due to the charged transaction fee. As a result, an inconsistency in the amount will occur and the transaction may fail due to the validation checks. For example, if a user sends 100 deflationary tokens (with a 10% transaction fee) to the target contract, only 90 tokens actually arrived in the contract.

LowIs It Possible to Withdraw TwiceFixed

There are 2 functions for the users to retrieve their tokens: - `OneChainDatesRefundVesting.withdraw()` : Will send the IDO tokens back to the user; In order to compute how many tokens will be sent, the function will call `withdrawableOf()`, which will call: ```solidity IBaseRefundRequester.ReturnRefundInfo memory info = IBaseRefundRequester(refund).infoOf( token_, identifier_, account_ ); totalClaimed += info.accountInfoOf.refundRequestedInToken; totalClaimed -= info.accountInfoOf.claimedRefundRequestedInToken; ``` - `BaseRefundClaimer.claimRefund()`: Will refund the user with the token that was used during the IDO (Buying token). In order to compute how many tokens will be sent, the function will call `_calculateRefundAmountInBuyToken()`, which will call `_getRefundAmountInIDOToken()`, which will ultimately call: ```solidity IBaseRefundRequester.ReturnRefundInfo memory info = IBaseRefundRequester(refundRequester).infoOf( token_, identifier_, account_ ); amount = info.accountInfoOf.refundRequestedWithMultiplierInToken; ``` Since those 2 functions call the same contract (`IBaseRefundRequester`), but not the same arguments to compute the refund, there is a risk that a user can call both of those functions to get a refund with the two methods.

LowLack of Input ValidationFixed

In function `initialize()`, the variable `bpPrecision_` should not be less than the variable `tgePercentage_`. Otherwise, the result will be extremely large due to underflow.

LowUnused Library `BP`Fixed

The library `BP` is never used within the project and thus can be removed.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (20)

  • contracts/interfaces/IReferrer.sol
  • contracts/vesting/BaseRefundVesting.sol
  • contracts/vesting/chains/OneChainRefundVesting.sol
  • contracts/BaseRoleChecker.sol
  • contracts/libraries/DatesVestingLibrary.sol
  • contracts/interfaces/IPool.sol
  • contracts/refundRequester/BaseRefundRequester.sol
  • contracts/interfaces/IRefundIDO.sol
  • contracts/vesting/types/OneChainDatesRefundVesting.sol
  • contracts/libraries/UQ112x112.sol
  • contracts/interfaces/IBaseRefundVesting.sol
  • contracts/refundClaimer/BaseRefundClaimer.sol
  • contracts/libraries/BP.sol
  • contracts/interfaces/IOneChainRefundVesting.sol
  • contracts/interfaces/IBaseRefundClaimer.sol
  • contracts/refundClaimer/OneChainRefundClaimer.sol
  • contracts/refundRequester/OneChainRefundRequester.sol
  • contracts/interfaces/IOneChainRefundClaimer.sol
  • contracts/interfaces/IBaseRefundRequester.sol
  • contracts/Registry.sol

Part of Uplift’s security record

Uplift
Audits1 audit by 1 firmLast audit Oct 2022, by CertiK.
Critical findingsNo open critical findingsIn 1 report.
Open Uplift’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us