Part of CertiK’s series
CertiK reviewed Venus Protocol (Venus - ACM Commands Aggregator) on 7 Oct 2024: 4 findings, 0 critical; 3 marked fixed, 1 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 1 | 0 | 3 |
Venus describes the intended use of this contract with their AccessControlManager as follows: 1. Preload permissions to be granted or revoked in the `AccessControlManager`. 2. Make a VIP on BNB Chain for three commands executed on the corresponding remote network. The three commands are: - Grant the `DEFAULT_ADMIN_ROLE` in the `AccessControlManager` to the `ACMCommandsAggregator`. - Execute functions `executeGrantPermissions()` or `executeRevokePermissions()` with chosen preloaded permission id as needed to grant or revoke the preloaded permissions within the `AccessControlManager`. - Revoke `DEFAULT_ADMIN_ROLE` from the `ACMCommandsAggregator`. The sequence of commands done in step 2 must be performed atomically within the same transaction. Otherwise, the protocol stands the risk of anyone granting or revoking permissions within the `AccessControlManager` within any of the remote chains. This is because all functions within the `ACMCommandsAggregator` are left permissionless. In addition, the permissions associated with the `index` provided must be carefully reviewed prior to the execution of the VIP to ensure that the proper permissions are granted/revoked. In particular, it should be ensured that the `index` is not referencing permissions that were added by unintended entities.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (1)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us