CertiK reviewed MUMUBIT TOKEN (mumubit) on 21 Aug 2024: 17 findings, 0 critical; 11 marked fixed, 4 acknowledged, 2 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 0 |
| Medium | 0 | 3 | 1 |
| Low | 2 | 0 | 10 |
In `TonClaim` contract the maps `claim_record` and `claim_list` are not bounded. As the contract's persistent state grows in size, read and write operations become more expensive in terms of gas. In extreme cases, they may cost more than a transaction's gas limit, rendering the contract unusable. Therefore, [it's important](https://tact-by-example.org/06-unbounded-arrays) to design contracts with an upper bound on state size.
The `TonClaim` `TokenNotification` works this way: 1. Ensures `sender() == self.this_contract_projectCoinWallet` 2. Updates `self.contract_balance` However, if some other unexpected jettons (like `invest_coin`) arrive, they will not be returned and will be blocked forever. The `MumubitIdo` `TokenNotification` handler only processes the jettons to `this_contract_investCoinWallet`. All the others are silently accepted. ```c=330 require(context().sender == self.this_contract_investCoinWallet, "not from the correct jetton wallet"); ``` The check is redundant. In case the payload is in an invalid format, the jettons are silently accepted with no compensation for the user. ```c=327 require(context().value >= ton("0.1"), "not enough value"); ``` Checking if enough gas provided in the `TokenNotification` handler increases the chances the jettons will be lost. It is redundant.
The report names a repository or files. Open the report to see its scope.
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us