RAI Finance
CertiK reviewed RAI Finance on 26 Oct 2022: 12 findings, 1 critical; 7 marked fixed, 2 acknowledged, 3 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Findings12
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 1 | 0 |
| High | 3 | 0 | 2 |
| Medium | 0 | 1 | 1 |
| Low | 0 | 0 | 4 |
CriticalCentralization Risk in Controller.solAcknowledged
In the contract, `Controller`, the role, `_owner`, has the authority over the functions shown in the diagram below. Any compromise to the privileged account which has access to `_owner` may allow the hacker to take advantage of this and drain out all `portfolio` assets by adding hacked module.  In the contract, `Controller`, the role, `isFactory`, has the authority over the functions shown in the diagram below. Any compromise to the privileged account which has access to `isFactory` may allow the hacker to take advantage of this. 
MediumLack of restrictions when calling `removeXXX`Acknowledged
The contract owner can call `removePortfolio`/`removeFactory`/`removeModule`/`removeResource` at any time, some functionalities depend on these values, for example, `PortfolioModule.redeem` can not be called when `portfolio` removed from the controller. So calling these functions should be limited to guarantee normal function logic.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (31)
- contracts/interfaces/IModule.sol
- contracts/ManagerModule.sol
- contracts/interfaces/ISOFIProxy.sol
- contracts/IntegrationRegistry.sol
- contracts/PortfolioModule.sol
- contracts/protocol-viewers/PortfolioViewer.sol
- contracts/interfaces/IManagerIssuanceHook.sol
- contracts/interfaces/IController.sol
- contracts/interfaces/IPortfolioModule.sol
- contracts/lib/AddressArrayUtils.sol
- contracts/interfaces/IIntegrationRegistry.sol
- contracts/PortfolioFactory.sol
- contracts/SOFITrading.sol
- contracts/protocol-viewers/ERC20Viewer.sol
- contracts/lib/UniSushiV2Library.sol
- contracts/protocol-viewers/ProtocolViewer.sol
- contracts/SOFIProxy.sol
- contracts/interfaces/IPortfolio.sol
- contracts/interfaces/ISOFIProxyAdapter.sol
- contracts/lib/PreciseUnitMath.sol
- contracts/lib/Invoke.sol
- contracts/SOFIProxyAdapter.sol
- contracts/lib/ExplicitERC20.sol
- contracts/lib/Position.sol
- contracts/Portfolio.sol
- contracts/lib/ModuleBase.sol
- contracts/interfaces/IWETH.sol
- contracts/UniswapV2ExchangeAdapter.sol
- contracts/Controller.sol
- contracts/lib/ResourceIdentifier.sol
- contracts/SimpleERC20.sol
Part of RAI Finance’s security record
RAI FinanceSecurity firm
CertiK1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us