CertiK reviewed liteusd.com (Lite Ⅳ) on 20 Oct 2022: 13 findings, 0 critical; 9 marked fixed, 1 acknowledged, 3 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 3 | 0 | 9 |
The if statements at lines 514 and 516 can be merged into one as the second if is more restrictive than the first one. The conditions can be written as it follows: - block.timestamp > userDepositDuration - block.timestamp > userDepositDuration + autoDelay
The functions which are never called internally within the contract should have external visibility for gas optimization.
The linked require statements have unclear error messages that can be changed as it follows: - The error message at line 314 can be changed to “Bonus is not enabled” - The error message at line 357 can be changed to “Staking is not enabled” - The error message at line 411 can be changed to “The inserted amount is greater than the current user's stake” - The error message at line 412 can be changed to “The inserted amount must be greater than zero” - The error message at line 422 can be changed to “The time passed since the last deposit is less than unstakeDuration” - The error message at line 427 can be changed to “The time passed since the last deposit is less than user.duration”
Since `_updatePool()` is called only in `_bonusReward()`, there is no need to check if `lastBounsToken` is greater than zero in each for-loop iteration. The check can be made once in `_bonusReward()` before the for-loop at line 329 starts.
The linked assignments are redundant. By default, values are initialized to 0 for `uint` and to `false` for a `boolean` value.
The user that calls `stake()` will have its `user.rewardOf` balance updated twice: - It is called first at line 367 inside the call to `_takeReward()` passing `pending` as input after having it calculated. - The second time at line 383 during the execution of `stake()` itself.
Suffixes like seconds, minutes, hours, days and weeks after literal numbers can be used to specify units of time where seconds are the base unit and units are considered naively in the following way: - 1 == 1 seconds - 1 minutes == 60 seconds - 1 hours == 60 minutes - 1 days == 24 hours - 1 weeks == 7 days
The contract contains typos that need to be changed as follows: - Line 95 change to `bonusDay`. - Line 96 change to `bonusDuration`. - Line 116 change to `lastBonusEpoch`. - Line 117 change to `lastBonusToken`. --- Note this is not all the locations, the following locations are marked above.
The require statement at line 148 is unnecessary if `upgradeAddress` is zero-checked in the constructor as suggested in `Missing checks or Input Validations` finding. --- The if condition at line 438 in `_unstake()` is redundant since it is always true. This because `_unstake()` is called only twice: - by `unstake()` and in that case the `_amount` passed as input is already less than or equal to `user.stakedOf` thanks to the check at line 411 - by `takeReward()` and in that case the `_amount` passed as input is exactly `user.stakedOf`
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (1)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us