CertiK reviewed Fenix on 13 Apr 2023: 8 findings, 0 critical; all marked fixed.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 0 | 7 |
In the function `calculateEarlyPayout()`, the following check is satisfied in the case where `block.timestamp < stake.startTs` *and* the status is not active. ```solidity=330 if (block.timestamp < stake.startTs && stake.status == Status.ACTIVE) revert FenixError.StakeNotStarted(); ``` However, if the `stake.status` is not set to `ACTIVE` while `block.timestamp` is less than `stake.startTs`, then this check will pass and the function will revert due to underflow at the subsequent line without an error message: ```solidity=332 uint256 termDelta = block.timestamp - stake.startTs; ``` The only way in which the `block.timestamp` is strictly less than the `stake.startTs` value is if a user directly inputs a stake that was not created by the contract. Moreover, the check that the `stake.status` is active appears to prevent this check from working correctly.
The contract `Fenix` inherits `IERC165`, but does not follow [IEP165](https://eips.ethereum.org/EIPS/eip-165#how-a-contract-will-publish-the-interfaces-it-implements) recommendation : \ `supportsInterface()` returns false when `interfaceID` is `0x01ffc9a7`. ---- It should also be noted that the contract could return `true` also for the `interfaceID` of `ERC20`.
In the function `endStake()`, the event `EndStake` is emitted twice with differing staking information.
The event `Redeemed` is inherited from `IBurnRedeemable` but never emitted in the contract.
The `XEN_ADDRESS` is hardcoded in `Fenix.sol` and does not correspond to a contract address on a mainnet environment. The address exists on BscScan testnet at [**https://testnet.bscscan.com/address/0xcb99cbfa54b88cda396e39abac010dfa6e3a03ee**](https://testnet.bscscan.com/address/0xcb99cbfa54b88cda396e39abac010dfa6e3a03ee), however, the contract is a BEP20 contract that appears incompatible with this implementation, since it does not possess functionality to call `onTokenBurned()` and does not have a public `burn()` function.
`0.8.19` versions of solidity may be too recent. New versions could introduce bugs that will be corrected later.
In the cited location, the word "calculate" is misspelled as `calcualte`.
The contract `Fenix` imports and inherits `Context.sol` from `OpenZeppelin`. This contract is already imported in `ERC20.sol`.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (1)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us