MetaSolare

CertiK5 Aug 2022Files named in the report

Audit

CertiK reviewed HashPort (MetaSolare) on 5 Aug 2022: 8 findings, 0 critical; 6 marked fixed, 1 acknowledged, 1 open.

No open critical findings

Open the report Open HashPort’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings8

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	1	2
Medium	0	0	1
Low	1	0	3

HighCentralization Related Risks in `proxy.sol`Fixed

In the contract `TransparentUpgradeableProxy`, the role `admin` has authority over the following functions: - change the admin of the proxy through `changeAdmin()` - upgrade the implementation of the proxy through `upgradeTo()` - upgrade the implementation of the proxy, and then call a function from the new implementation as specified by `data` through `upgradeToAndCall()`

HighCentralization Risks in MetaSolare.solFixed

In the contract `MetaSolare`, the role `MINTER_ROLE` has authority over the following functions, any compromise to the `account` account may allow the hacker to take advantage of this authority - grant `role` to `account` through `grantRole()` - revoke `role` from `account` through `revokeRole()` - mint up to the cap of tokens to anyone through `mint()`

MediumPotential Front-Running RiskFixed

Malicious hackers may observe the pending transaction which will execute the `init()` function, and launch a similar transaction but with the hacker's address of `_tokenAdmin` and gain ownership of the contract.

LowLack of Input ValidationFixed

The assigned value should be verified as a non-zero value to prevent being mistakenly assigned as `address(0)` in the function.

LowMissing Emit EventsFixed

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

LowToo Many DigitsFixed

Literals with many digits are difficult to read and review. ```solidity=833 _cap = 8000000000*10**18; ```