Chain - XCN Token

CertiK6 Mar 2022Files named in the report

CertiK reviewed Onyx Protocol (Chain - XCN Token) on 6 Mar 2022: 5 findings, 0 critical; 3 marked fixed, 1 acknowledged, 1 open.

No open critical findings

Open the report Open Onyx Protocol’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings5

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	1	0
Medium	0	0	0
Low	1	0	3

LowFork LeftoversFixed

The linked error messages use `COMP` as the project name, which is fork leftover. ```solidity=554 require(signatory != address(0), "Comp::delegateBySig: invalid signature"); require(nonce == nonces[signatory]++, "Comp::delegateBySig: invalid nonce"); require(now <= expiry, "Comp::delegateBySig: signature expired"); ```

LowStrict ConditionalFixed

The linked conditional conducts a strict comparison between `value` and ChainToken balance. However, the check should be passed when `balanceOf(msg.sender)` = `value`.

LowUnlocked Compiler VersionFixed

The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to different compiler versions. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.