Ongo

CertiK27 Dec 2022Files named in the report

Audit

CertiK reviewed OnGO on 27 Dec 2022: 13 findings, 0 critical; 11 marked fixed, 1 acknowledged, 1 open.

No open critical findings

Open the report Open OnGO’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings13

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	1	0
Medium	0	0	0
Low	1	0	11

LowAmount Check Before Reward UpdateFixed

In the function `stakeReward`, the stake `_amount` check is before the calling of the function `_updateStakeholderReward(msg.sender)`. The user may have unsettled rewards and can only stake part of the `totalReward`.

LowDurations should be checked in function `launchNeFixed

In the function `launchNextPhase()`, it does not require that the durations of each stage have already been set to launch the registration phase from setup. If these durations are still default values, there is no deadline for the stage.

LowFunctions for testing purposeFixed

The function `updateMaxNbTokensPerPartAtPP()` can be called by anyone as it has no access restriction. It is for testing purpose and should be removed in the deployment version.

LowIncreasing order does not include RUBY typeFixed

The function `setTiersTokensAllocationFactors()` does not require sapphire factor greater than ruby factor.

LowPotential Out-of-Gas ExceptionFixed

The function `adjustRewardRatePer1TFTG()` has to update rewards for all users, which may lead to an out-of-gas error.

LowRedundant codeFixed

The difference between the case `_lockDuration == 0` and `_lockDuration >= 30 days` is that the condition `_lockDuration >= 30 days` should increase `stakeholders[msg.sender].totalLockedBalance`.

LowUnchecked Value of ERC-20 `transfer()`/`transferFFixed

The linked `transfer()`/`transferFrom()` invocations do not check the return value of the function call, which should yield `true` in the case of a proper ERC-20 implementation.

LowUnknown Imported Source FileFixed

The imported source files - `import "OpenZeppelin/openzeppelin-contracts@4.1.0/contracts/token/ERC20/IERC20.sol";` - `import "paulrberg/prb-math@2.5.0/contracts/PRBMath.sol";` - `import "OpenZeppelin/openzeppelin-contracts@4.1.0/contracts/access/Ownable.sol";` are not existing in the current scope of the audit codebase.

LowUnsafe Type ConversionFixed

The linked statements cast between type `uint256` and `int256` without evaluating the bounds. If the most significant bit is 1, the casting result will be deducted by the Two's complement which may be not a correct result.

LowUser-Defined GettersFixed

The linked functions are equivalent to the compiler-generated getter functions for the respective variables.

Show 1 more

LowVariables That Could Be Declared as ImmutableFixed

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.