RAI Finance

CertiK26 Oct 2022Files named in the report

Audit

CertiK reviewed RAI Finance on 26 Oct 2022: 12 findings, 1 critical; 7 marked fixed, 2 acknowledged, 3 open.

1 critical acknowledged, not fixed

Open the report Open RAI Finance’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings12

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	1	0
High	3	0	2
Medium	0	1	1
Low	0	0	4

HighCalling `removeModule` Should Be LimitedOpen

The `manager` can call `removeModule` at any time, if `PortfolioModule` is removed, `PortfolioModule.redeem` can not be called on this `portfolio`, users can not `redeem` their assets. So limit calling `removeModule` is necessary.

HighCentralization Risk in PortfolioFactory.solOpen

In the contract, `PortfolioFactory`, the role, `_owner`, has the authority over the functions shown in the diagram below. Any compromise to the privileged account which has access to `_owner` may allow the hacker to take advantage of this and [fixme]. ![](https://accelerator-tasks-prod.acc.corp.certik.com/6aaa6dba5d8943948d210605ffea44dd/PortfolioFactory-_owner.svg)

HighMalicious Users Can Create And Manipulate `PortfoOpen

Everyone can call `PortfolioFactory.create` to create a `Portfolio` with specified `manager`. The `manager` can call `ManagerModule.trade` to swap one token to another token, malicious users can get profit from this `trade`, but the assets of `Portfolio` are lost. An example looks like `Sandwich Attacks`, the `manager` calls the function `ManagerModule.trade` with meager `_minReceiveQuantity` value, and sandwich attack himself to get profit.