CertiK reviewed MUMUBIT TOKEN (mumubit) on 21 Aug 2024: 17 findings, 0 critical; 11 marked fixed, 4 acknowledged, 2 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 0 |
| Medium | 0 | 3 | 1 |
| Low | 2 | 0 | 10 |
The `TonClaim` contract uses `contract_balance` to account for the `this_contract_projectCoinWallet` jetton balance. However, the value may become obsolete: 1. `WithdrawFunds` handler extracts the funds but doesn't update the `contract_balance`. 2. Assigning a different `this_contract_projectCoinWallet` via the `SetProjectCoinAddress` message makes the `contract_balance` irrelevant. 3. `TokenNotification` handler will only be executed if the jettons are sent to the contract wallet with non-zero `forward_ton_amount`. Otherwise, the `TonClaim` will not be notified and the funds will be blocked. 4. `AdminCorrectRecord` message can adjust the `contract_balance`, but only if `ido_claim_amount` is big enough.
```c=518 let decimalsDiff: Int = self.projectCoinDecimals - self.investCoinDecimals; let adjustedAmount: Int = oldIdo.jettonIdoAmount * pow(10, decimalsDiff); ``` The code [assumes](https://docs.tact-lang.org/ref/core-math#pow) the `decimalsDiff` is non-negative, however, that is not guaranteed.
`non_reentrant_lock` is redundant. In TON during the processing of one message no external calls to another/same contract can be made. After the transaction execution the contract state changes are saved and prepared message queue is processed. Due to that using `lockContract()` at the message handler start and `unlockContract()` at the handler end is redundant. The execution can't be interrupted by other messages processing.
[Struct.fromSlice()](https://docs.tact-lang.org/ref/core-cells#structfromslice) should be used instead of manual slice decoding.
```c=179 self.index = (self.index + 1); ``` Compound assignment operators can be used for better clarity and efficiency. The statement `self.index += 1` achieves the same result but is more concise and idiomatic. This not only improves code readability but also reduces the likelihood of errors and enhances code maintainability by adhering to common programming conventions.
[TEP-74 standard](https://github.com/ton-blockchain/TEPs/blob/master/text/0074-jettons-standard.md) allows `response_destination` to be `addr_none (b00)`. In this case, the `excesses` message is not sent. However, the `TokenTransfer` declaration doesn't allow an empty address. This practically makes the argument non-optional, which can surprise the jetton users.
`TonClaim.projectCoinDecimals` is set during the contract deployment but never used. It can be arbitrary. The real project coin decimals should be obtained off-chain from the project coin master contract. `tonDecimals` is never used. `project_coin_address` can be arbitrary and can be changed by the `owner` at any time. `this_contract_projectCoinWallet` should be either derived from the `project_coin_address`, or the project coin address should be obtained off-chain from the wallet `get_jetton_data()` result. `MumubitIdo.raise_status` can be arbitrary.
```c=28 // 500 should be devided by 10000; ``` - "devided" is supposed to be "divided" - 10000 is supposed to be 1000 - "excludeed" is supposed to be "excluded"
There is redundant code and leftovers.
The variable `TonClaim.tonDecimals` is assigned but never changed. It can be declared as [constant](https://docs.tact-lang.org/book/constants).
```c=80 self.invest_coin_address = investCoinAddress; self.this_contract_investCoinWallet = investCoinAddress; // let myInit= initOf JettonDefaultWallet(investCoinAddress,myAddress()); // self.this_contract_investCoinWallet = contractAddress(myInit); // self.investCoinDecimals = 6; // ton usdt 6 decimals self.project_coin_address = projectCoinAddress; self.this_contract_projectCoinWallet = projectCoinAddress; ``` `this_contract_investCoinWallet` and `this_contract_projectCoinWallet` are initialized with wrong addresses. They should be either derived from `investCoinAddress`/`projectCoinAddress`, or `investCoinAddress`/`projectCoinAddress` should be removed.
The report names a repository or files. Open the report to see its scope.
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us