CertiK reviewed ShadowFi on 21 Oct 2022: 18 findings, 0 critical; 8 marked fixed, 1 acknowledged, 9 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 9 | 0 | 8 |
The airdrop sets the users to true after the call, but it does not check if the user has already been sent an airdrop. This might cause errors in accidentally double sending tokens.
The function `airdrops()` can send multiple users tokens. Because this is a for loop, each call uses more gas as it successfully transfers tokens. If the list is big enough in one call, it could potentially hit the block limit.
A small amount of BNB will be left in contract after each call. Typically very small, but will be locked forever. This is not worth adding a check and correcting this because it will typically increase the gas costs more than what is "saved".
State variables are inline initialized using either non-constant state variable or function calls that are not pure/constant. Since inline initialization occurs before constructor call, some non-constant state variables may not be initialized and non-constant functions may behave in an unexpected way. ```solidity=550 uint256 public _maxTxAmount = _maxSupply / 1000; // 0.1% ``` --- ```solidity=595 uint256 public swapThreshold = _totalSupply / 5000; // 0.02% ```
It is recommended emitting events for the sensitive functions that are controlled by centralization roles or are important for users. The functions referenced above do not emit events. For example: - `setDistributionCriteria()` - `setTxLimit()`
The address noted above should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=306 owner = adr; ``` - `adr` is not zero-checked before being used.
The variables inside of `setDistributionCriteria()` have no boundaries and can be set arbitrarily. These variables dictate the time and minimal amount of tokens for distribution inside of `DividendDistributor`. These variables should have a error boundary check.
The following state variables never change should be declared as `constant` to save gas. - `WBNB` - `dividendsPerShareAccuracyFactor` - `BUSD` - `DEAD` - `ZERO` - `_totalSupply` - `_maxSupply`
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (2)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us