FibSWAP DEx - Audit 2

CertiK4 Oct 2022Files named in the report

CertiK reviewed FibSwapDex (FibSWAP DEx - Audit 2) on 4 Oct 2022: 5 findings, 0 critical; 1 marked fixed, 1 acknowledged, 3 open.

No open critical findings

Open the report Open FibSwapDex’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings5

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	3	0	0
Medium	0	0	0
Low	0	1	1

HighCentralization Risks in Fibswap.solOpen

In the contract `Fibswap` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and change the contract state variables and the contract behavior. ![](https://accelerator-tasks-prod.acc.corp.certik.com/205b0975c01e4910ad626f798686b0c1/diagrams/centralization_Fibswap-Fibswap-_owner.svg) ![](https://accelerator-tasks-prod.acc.corp.certik.com/205b0975c01e4910ad626f798686b0c1/diagrams/centralization_Fibswap-OwnableUpgradeable-_owner.svg) ![](https://accelerator-tasks-prod.acc.corp.certik.com/205b0975c01e4910ad626f798686b0c1/diagrams/centralization_Fibswap-OwnerPausableUpgradeable-_owner.svg)

HighCentralized Control of Contract UpgradeOpen

`Fibswap` is an upgradeable contract, the owner can upgrade the contract without the community's commitment. If an attacker compromises the account, he can change the implementation of the contract and drain tokens from the contract.

HighPotential Centralization RisksOpen

According to the contract logic, the user calls `xcall` to transfer tokens to this chain, and then the router calls `execute` to transfer tokens to the `dest` address on the other chain. There is a potential centralization risk, the router can choose to call `execute` or not, or the router can just call `removeLiquidity` to withdraw tokens that belong to the user. The user needs to know this potential risk.