KyotoSwap

CertiKFiles named in the report

CertiK reviewed KyotoSwap on 21 Apr 2023: 17 findings, 0 critical; 5 marked fixed, 3 acknowledged, 9 open.

No open critical findings
Open the reportOpen KyotoSwap’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings17

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium031
Low904
Medium`add()` Function Not RestrictedAcknowledged

When the same LP token is added into a pool more than once in the function `add()`, the total amount of reward in the function `updatePool()` will be incorrectly calculated. The current implementation mentioned this in the code comments but still relies on the operation correctness to avoid repeatedly adding the same LP token to the pool, as the function will only be called by the `MANAGER_ROLE`.

MediumCharging Additional FeesAcknowledged

Besides the 3/1000 trading fees, the contract `swap` will charge the controller fee and transfer to the address `controllerFeeAddress` directly. However, this fee is deduced directly from the `amount0Out` and `amount1Out`, so it still participates in the constant-product invariant calculation. This logic is inconsistent with the design of Uniswap, where the trading fee is applied before enforcing the constant-product invariant. The constant-product invariant check is bypassed. The outputs of the users' swap operations may get different results with the function `getAmountOut()`.

MediumInconsistent FeesAcknowledged

In the `KyotoSwapLibrary` contract, all the transactions will be charged 0.3% of the transaction amount as the fee for liquidity providers. In the `KyotoSwapPair` contract, the `swap()` function will check whether the amount of the two tokens in the pair contract after deducting the `feeAmount` meets the K value (`balance0Adjusted` and `balance1Adjusted`). The `feeAmount` is limited between 0.01% and 0.25% instead of 0.3%(30). As a result, the constant-product invariant check condition does not match the actual fee rate, which makes the invariant check unreasonable. KyotoSwapLibrary: ```solidity function getAmountOut(uint amountIn, uint reserveIn, uint reserveOut) internal pure returns (uint amountOut) { require(amountIn > 0, 'KyotoSwapLibrary: INSUFFICIENT_INPUT_AMOUNT'); require(reserveIn > 0 && reserveOut > 0, 'KyotoSwapLibrary: INSUFFICIENT_LIQUIDITY'); uint amountInWithFee = amountIn.mul(997); uint numerator = amountInWithFee.mul(reserveOut); uint denominator = reserveIn.mul(1000).add(amountInWithFee); amountOut = numerator / denominator; } ``` `KyotoSwapPair`: ```solidity function swap(uint amount0Out, uint amount1Out, address to, bytes calldata data) external lock { ... { // scope for reserve{0,1}Adjusted, avoids stack too deep errors uint balance0Adjusted = (balance0.mul(10000).sub(amountsIn.amount0In.mul(feeAmount))); uint balance1Adjusted = (balance1.mul(10000).sub(amountsIn.amount1In.mul(feeAmount))); require(balance0Adjusted.mul(balance1Adjusted) >= uint(_reserve0).mul(_reserve1).mul(10000**2), 'KyotoSwapPair: K'); } ... } ```

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (11)

  • contracts/WETH.sol
  • contracts/MasterChef.sol
  • contracts/KyotoSwapPair.sol
  • contracts/KyotoSwapERC20.sol
  • contracts/KswapToken.sol
  • contracts/KyotoSwapFactory.sol
  • contracts/token-locker/ITokenLocker.sol
  • contracts/KyotoSwapLibrary.sol
  • contracts/token-locker/TokenLocker.sol
  • contracts/token-locker/LibTokenLocker.sol
  • contracts/KyotoSwapRouter.sol

Part of KyotoSwap’s security record

KyotoSwap
Audits1 audit by 1 firmLast audit Apr 2023, by CertiK.
Critical findingsNo open critical findingsIn 1 report.
Open KyotoSwap’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us