Lite Ⅳ

CertiK20 Oct 2022Files named in the report

Audit

CertiK reviewed liteusd.com (Lite Ⅳ) on 20 Oct 2022: 13 findings, 0 critical; 9 marked fixed, 1 acknowledged, 3 open.

No open critical findings

Open the report Open liteusd.com’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings13

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	1	0
Medium	0	0	0
Low	3	0	9

LowMissing Emit EventsOpen

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

LowMissing Input ValidationOpen

The following are missing range bound checks: - `day` in `setBounsDay()` - `_duration` in `addPool()` - `_duration` in `setPool()` - `value` in `setAutoDelay()` - `_duration` in `setUnstakeDuration()` ---- The following are missing zero address checks: - `token_` and `upgrade_` addresses passed to the constructor - `_lpToken` in `setPool()` - `_lpToken` in `addPool()`

LowPotential Loss of Rewards and DepositsOpen

If `initUpgrade()` is called after `depositReward()`, the current value of `totalReward` will be overridden by the `totalReward` of the `upgradeAddress`. --- If `initUpgrade()` is called after `stake()`, the current value of `totalStaked` will be overridden by the `totalStaked` of the `upgradeAddress`. Note that if `isStaking` is changed to true through `setStaking()` and a new pool is added through `addPool()`, it will be possible to call `stake()` and so write to `totalStaked` --- If `initUpgrade()` is called after `stake()` (which executes `_bonusReward()`), the current values of `lastBounsEpoch` and `lastBounsToken` will be overridden by `lastBounsEpoch` and `lastBounsToken` of the `upgradeAddress`. Note that if `isStaking` and `isBonus` are changed to true through `setStaking()` and `setIsBouns()` and a new pool is added through `addPool()`, it will be possible to call `stake()` which executes `_bonusReward()`.