Shadowfi

CertiKFiles named in the report

CertiK reviewed ShadowFi on 21 Oct 2022: 18 findings, 0 critical; 8 marked fixed, 1 acknowledged, 9 open.

No open critical findings
Open the reportOpen ShadowFi’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings18

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High010
Medium000
Low908
Low`airdrop()` Missing ValidationFixed

The airdrop sets the users to true after the call, but it does not check if the user has already been sent an airdrop. This might cause errors in accidentally double sending tokens.

Low`airdrop()` Will Eventually Hit Block LimitFixed

The function `airdrops()` can send multiple users tokens. Because this is a for loop, each call uses more gas as it successfully transfers tokens. If the list is big enough in one call, it could potentially hit the block limit.

LowBNB Locked In Contract Over TimeFixed

A small amount of BNB will be left in contract after each call. Typically very small, but will be locked forever. This is not worth adding a check and correcting this because it will typically increase the gas costs more than what is "saved".

LowFunction Initializing StateFixed

State variables are inline initialized using either non-constant state variable or function calls that are not pure/constant. Since inline initialization occurs before constructor call, some non-constant state variables may not be initialized and non-constant functions may behave in an unexpected way. ```solidity=550 uint256 public _maxTxAmount = _maxSupply / 1000; // 0.1% ``` --- ```solidity=595 uint256 public swapThreshold = _totalSupply / 5000; // 0.02% ```

LowMissing Emit EventsFixed

It is recommended emitting events for the sensitive functions that are controlled by centralization roles or are important for users. The functions referenced above do not emit events. For example: - `setDistributionCriteria()` - `setTxLimit()`

LowMissing Input ValidationFixed

The address noted above should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=306 owner = adr; ``` - `adr` is not zero-checked before being used.

LowUnknown BoundsFixed

The variables inside of `setDistributionCriteria()` have no boundaries and can be set arbitrarily. These variables dictate the time and minimal amount of tokens for distribution inside of `DividendDistributor`. These variables should have a error boundary check.

LowVariables Should Be Declared ConstantFixed

The following state variables never change should be declared as `constant` to save gas. - `WBNB` - `dividendsPerShareAccuracyFactor` - `BUSD` - `DEAD` - `ZERO` - `_totalSupply` - `_maxSupply`

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (2)

  • ShadowFi.sol
  • ShadowFiLiquidityVault.sol

Part of ShadowFi’s security record

ShadowFi
Audits2 audits by 2 firmsLast audit May 2024, by Cyberscope.
Critical findings2 open critical findingsReported in “ShadowGold” by Cyberscope, May 2024. Not marked fixed in that report.
Open ShadowFi’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us