CertiK reviewed Noti on 9 Sep 2024: 5 findings, 0 critical; 3 marked fixed, 2 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 2 | 0 | 0 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 0 | 2 |
The function `withdraw` uses `{value:}` structure and is designed to withdraw ether from the contract, but the `receive` function is missing from the `Noti` contract, making it impossible to receive native tokens.
The change of `_owner` by function `transferOwnership()` overrides the previously set `_owner` with the new one without guaranteeing the new `_owner` is able to actuate transactions on-chain.
The linked comments indicate that the project utilizes a tax mechanism and the function `setExclusion` can exclude any provided address from tax. ```solidity=628 /** * @dev Updates the exclusion status of an address. * @param _account The address to update. * @param isExcluded_ Whether the address is excluded from tax. */ function setExclusion(address _account, bool isExcluded_) external onlyOwner { isExcluded[_account] = isExcluded_; } ``` However, the implementation only exclude the addresses stored in the `isExcluded` list from transfer. ```solidity=579 /** * @dev Overrides the transferFrom function to include tax logic. * @param from The address to transfer from. * @param to The address to transfer to. * @param amount The amount to be transferred. * @return A boolean value indicating whether the operation succeeded. */ function transferFrom(address from, address to, uint256 amount) public virtual override returns(bool) { address spender = _msgSender(); _spendAllowance(from, spender, amount); // Transfer the full amount if sender or recipient is excluded from tax _transfer(from, to, amount); return true; } function _transfer(address sender, address recipient, uint256 amount) internal override { require(contractState == ContractState.ON || isExcluded[sender] || isExcluded[recipient], "Incorrect state!"); super._transfer(sender, recipient, amount); } ```
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (1)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us