Lithium Finance Ⅳ

CertiK13 Dec 2022Files named in the report

CertiK reviewed Lithium Finance (Lithium Finance Ⅳ) on 13 Dec 2022: 14 findings, 0 critical; 5 marked fixed, 9 acknowledged.

No open critical findings

Open the report Open Lithium Finance’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings14

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	0	0
High	1	0
Medium	1	0
Low	7	5

LowKey values could be set without reasonable boundaFixed

The variable `_burnRate` and `maxRewardRp` could be set without reasonable boundaries, hence they could be set arbitrarily.

LowLogical issue of `refundAnswer()`Fixed

Whether the price expert's answer is correct or not, the corresponding stake token and RP_TOKEN can always be refunded. Therefore, the staked token cannot restrict malicious quotations, and as a winner, the staked token cannot affect the reward obtained. Hence we would like to know the role of the staked token.

LowLogical issue of the `withinStakeLimits()`Fixed

When the values of `_stakeToken` and `_rp` are both greater than their respective thresholds (`tokenStakeThreshold` and `rpStakeThreshold`), the `maxRPMultiplier` should ensure that the result of `(_rp * enquiries[_enquiryId].maxRPMultiplier) / precision` is greater than the `tokenStakeThreshold`, or the transaction will be reverted. This condition is necessary to prevent potential issues with the stake thresholds.

LowTokens refunded to an EOA instead of the `seeker`Fixed

When invoking `refundEnquiry()`, all of the reward tokens are transferred to the `treasury` instead of the seeker who initially provide the fund.

LowUnlocked Compiler VersionFixed

The contracts cited have an unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to ambiguity when debugging, as compiler-specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.