mumubit

CertiKCode version: not recorded (see the report)

CertiK reviewed MUMUBIT TOKEN (mumubit) on 21 Aug 2024: 17 findings, 0 critical; 11 marked fixed, 4 acknowledged, 2 open.

No open critical findings
Open the reportOpen MUMUBIT TOKEN’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings17

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High010
Medium031
Low2010
LowUnbounded data structuresOpen

In `TonClaim` contract the maps `claim_record` and `claim_list` are not bounded. As the contract's persistent state grows in size, read and write operations become more expensive in terms of gas. In extreme cases, they may cost more than a transaction's gas limit, rendering the contract unusable. Therefore, [it's important](https://tact-by-example.org/06-unbounded-arrays) to design contracts with an upper bound on state size.

LowUnsafe handle of `TokenNotification`Open

The `TonClaim` `TokenNotification` works this way: 1. Ensures `sender() == self.this_contract_projectCoinWallet` 2. Updates `self.contract_balance` However, if some other unexpected jettons (like `invest_coin`) arrive, they will not be returned and will be blocked forever. The `MumubitIdo` `TokenNotification` handler only processes the jettons to `this_contract_investCoinWallet`. All the others are silently accepted. ```c=330 require(context().sender == self.this_contract_investCoinWallet, "not from the correct jetton wallet"); ``` The check is redundant. In case the payload is in an invalid format, the jettons are silently accepted with no compensation for the user. ```c=327 require(context().value >= ton("0.1"), "not enough value"); ``` Checking if enough gas provided in the `TokenNotification` handler increases the chances the jettons will be lost. It is redundant.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of MUMUBIT TOKEN’s security record

MUMUBIT TOKEN
Audits4 audits by 1 firmLast audit Mar 2025, by CertiK.
Critical findingsNo open critical findingsAcross the 4 reports, 5 critical findings were reported. Each is marked fixed by the firm that reported it.
Open MUMUBIT TOKEN’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us