RareSwap
CertiK reviewed RareSwap on 12 Sep 2022: 10 findings, 3 critical; 1 marked fixed, 4 acknowledged, 5 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Findings10
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 2 | 1 |
| High | 0 | 1 | 0 |
| Medium | 0 | 1 | 0 |
| Low | 5 | 0 | 0 |
CriticalCentralization Risk in RARESwapFactory.solAcknowledged
In the contract `RARESwapFactory` the role `feeToSetter` has authority over the functions shown in the diagram below. Any compromise to the `feeToSetter` account may allow the hacker to take advantage of this authority.  In the contract `RARESwapPair` the role `feeTaker` has authority over the functions shown in the diagram below. Any compromise to the `feeTaker` account may allow the hacker to take advantage of this authority. 
CriticalCentralization Risk in RARESwapRouter.solAcknowledged
In the contract `FeeStore` the role `_owner` has authority over the functions below: - feeAdddressSetWhileSwap - setAdminFee Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.
HighHighly likely incompatible functionalitiesAcknowledged
The contract allows token contract to set `basetToken`. However, almost all of the token contracts does not provide such functionality. If the token has such functionality, it is possible for the token to drain the related pool.
MediumThird Party DependenciesAcknowledged
The contract is serving as the underlying entity to interact with third party Itoken interface. The scope of the audit treats 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.
Contracts in scope3
| Address | Chain | Source code |
|---|---|---|
| 0xf8262a34300a3115dfcb9e46897746673ef7b97d | Chain: Ethereum | Source code: Verified source |
| 0x3c34473c1175a7b4eaa697356d6a6dc2618d273f | Chain: Ethereum | Source code: Verified source |
| 0x9deeb73e971127b2634d7633182004380774451f | Chain: Ethereum | Source code: Verified source |
Part of RareSwap’s security record
Security firm
CertiK1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us