DEIN Finance

Resonance Security16 Apr 2025Code version: not recorded (see the report)

Audit · firm’s term: audit report

Resonance Security reviewed DEIN Finance on 16 Apr 2025: 12 findings, 0 critical; 8 marked fixed, 4 open.

No open critical findings

Open the report Open DEIN Finance’s security record

Report stored on IPFS. Content hash QmagYTKzaHYxA4nTUZmogTB1kd8DE2cpZc9b1mN7GFkR9q

Trustblock does not review code.

Findings12

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	0	0
Medium	2	0
Low	2	8

Lowepoch in buyPolicy() Does Not Follow DocumentationFixed

The documentation and the frontend show that the insurance duration should be between 1 and 15 epoch but it is possible to call buyPolicy with a higher value.

LowevidenceURI Could Contain Malicious PayloadsFixed

The evidenceURI added during claims is not sanitized and could allow room for json injection attacks or bad chars that could affect the web2 infrastructure.

LowExecution at Deadlines Should Be AllowedFixed

validToTime in the _isDiscountModelActive() function specifies whether a discount is applied until the specified date, but it may also be applicable in the scenario where block.timestamp is equal to validToTime.

LowHardcoded blocks_per_day May Fail in L2 Chains or Consensus UpgradesFixed

Hardcoding blocks_per_day in a smart contract can lead to several issues, mainly because the actual block time on Ethereum can fluctuate. This may lead to inaccurate time calculations, incorrect rewards and interest or incompatibility across L2 chains.

LowMissing Limits In setMinimumInsuranceCost()Fixed

The setMinimumInsuranceCost() function does not limit the insurance cost. This may affect the user experience and it may not be practical.

LowNon-external Function Names Should Begin With an UnderscoreFixed

According to the Solidity Style Guide, non-external function names should begin with an underscore.

LowTWAP Oracle Update Mechanism Cannot Be Left To UsersFixed

The UniswapV2OracleLibrary is used to calculate prices based on the Uniswap V2 cumulative price, so contracts must manually call functions that capture the priceCumulativeLast.Discontinuous reporting may break the concept of TWAP and lead to unequal weightings to certain data points or price mismatch in case prices fluctuate rapidly.In case of low activity, the protocol updates the prices automatically every 3 days, but this time may not be enough.

Lowuint Should Not Be Initialized With 0Fixed

Initializing variables to their default values spends gas unnecessarily.