xWin Finance (Audit 2)

CertiKFiles named in the report

CertiK reviewed xWIN Finance (xWin Finance (Audit 2)) on 13 Jun 2023: 66 findings, 2 critical; 57 marked fixed, 1 acknowledged, 8 open.

2 critical findings, fixed
Open the reportOpen xWIN Finance’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings66

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical002
High015
Medium009
Low8041
HighCentralization Related RisksAcknowledged

In the `fundV2` contract, the role `owner` has authority over the following functions: - `init()` to set parameters. - `MoveNonIndexNameToBase()` to swap any token in the pool to base currency. - `setOpenForPublic()` to set the pool to public or private. - `updateOtherProperties()` to set `rebalanceCycle`, `smallRatio` and `_UPMultiplier`. - `updateBlockPerday()` to set `blocksPerDay`. - `updatePlatformProperty()` to update `platfromWallet` and `platformFee`. - `updateManagerProperty()` to set manager, rebalancing manager, and management fees. - `updatexWinEngines()` to set the address to price master and xwin swap contracts. - `updateLockedStakingAddress()` to set `lockingAddress` - `addContractWaiveFee()` and `removeContractWaiveFee` to manage the address that can be waived for performance fees. The `RebMaager` has authority over the following functions: - `createTargetNames()` to set the distribution of assets. - `Rebalance()` to perform rebalance with new weight and reset next rebalance period - `setValidInvestor()` to set valid investors. --- In the `fundV2Factory` contract, the role `owner` has authority over the following functions: - `createFund()` to create a new fund with the given parameters. - `initialiseFund()` to initialize a fund with the given parameters. - `setSwapAddr()` to set the address for the `xWinSwap` contract. - `addNewBaseToken()` to add a new supported base token. - `removeBaseToken()` to remove a supported base token. - `updatePriceMaster()` to update the `xWinPriceMaster` contract address. - `setProperties()` to set the default properties for the funds. - `addWhiteList()` to add an address to the whitelist. - `removeWhiteList()` to remove an address from the whitelist. - `setPause()` to pause or unpause a fund. - `setAdminWallet()` to set the address for the `xWinAdminWallet`. - `setEmitEvent()` to set the address for the `xWinEmitEvent` contract. - `setAutoLock()` to set the address for the `xWinLockStaking` contract. - `setCreationFee()`: set the creation fee for new funds. --- In the `UniSwapV2TWAPOracle` contract, the role `owner` has authority over the following functions: - `addPair()` to add a new pair to the registry. - `setPeriod()` to update the period for the contract. - `renounceOwnership()` to renounce ownership of the contract. - `transferOwnership()` to transfer ownership of the contract. The ownership of these functions is controlled by the `owner` role. --- In the `xWinEmitEvent` contract, the role `executor` has authority over the following functions: - `FeeEvent()` to emit a fee collection event. - `FundEvent()` to emit a fund activity event. The role `admin` has authority over the following functions: - `setExecutor()` to add or remove executor addresses. - `setAdmin()` to add or remove admin addresses. --- In the `xWinPriceMaster` contract, the role `executor` has authority over the following functions: - `addPrice()` to add a price source for a token pair. - `addChainlinkUSDPrice()` to add a Chainlink USD price source for a token. - `setExecutor()` to add or remove an executor address. The role `owner` has authority over the following functions: - `initialize()` to initialize the contract. - `setTWAPOracle()` to set the TWAP Oracle address. - `updateStratInteractor()` to update the `stratInteractor` address. --- In the `xWinStrategy` contract, the role `owner` has authority over the following functions: - `setEmitEvent(address _addr)` to set the address of the `IxWinEmitEvent` contract. - `updateUSDAddr(address _newUSDAddr)` to update the address of the stablecoin USD. - `setPause()` to pause the contract. - `setUnPause()` to unpause the contract. --- In the `xWinStrategyWithFee` contract, the role `owner` has authority over the following functions: - `updateLockedStakingAddress()` to set the address for the Locked Staking contract. - `setPerformanceFee()` to set the performance fee rate. - `setManagerFee()` to set the manager fee rate. - `setPerformanceCollectionPeriod()` to set the period for performance collection. - `setBlockPerDay()` to set the number of blocks per day. - `setManagerWallet()` to set the wallet for the strategy manager. - `addWaiveFee()` to add an address that is exempt from performance fees. - `removeWaiveFee()` to remove an address from performance fee exemption. The role `strategyManager` can influence the following processes: - In `collectFundFee()`, the manager can collect the fund fee and receive new shares. - In `collectPerformanceFee()`, the manager can collect the performance fee if the conditions are met and receive new shares. - In `performanceWithdraw()`, the manager can receive a fee from the profit made by a withdrawal. --- In the `xWinStrategyInteractor` contract, the role `admin` has authority over the following functions: - `registerStrategyContract()` to register and activate a strategy contract. - `activateStrategy

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (25)

  • contracts/fundV2Factory.sol
  • contracts/UniSwapV2TWAPOracle.sol
  • contracts/strategies/xWinDollarCostAverage.sol
  • contracts/xWinSystemExecutor.sol
  • contracts/xWinStrategyInteractor.sol
  • contracts/Library/TransferHelper.sol
  • contracts/strategies/xWinBBMA.sol
  • contracts/strategies/xWinERC20Alpha.sol
  • contracts/xWinStrategyWithFee.sol
  • contracts/xWinStrategy.sol
  • contracts/xWinSwapV3.sol
  • contracts/strategies/xWinSingleAssetAave.sol
  • contracts/strategies/xWinSingleAsset.sol
  • contracts/xWinEmitEvent.sol
  • contracts/strategies/xWinBuddyChef.sol
  • contracts/xWinSwap.sol
  • contracts/strategies/xWinSingleAssetAlpaca.sol
  • contracts/strategies/xWinMasterChef.sol
  • contracts/strategies/xWinSingleAssetOla.sol
  • contracts/Library/xWinLib.sol
  • contracts/strategies/xWinIRT.sol
  • contracts/fundV2.sol
  • contracts/xWinPriceMaster.sol
  • contracts/xWinSplitFeeWallet.sol
  • contracts/strategies/xWinLockedStake.sol

Part of xWIN Finance’s security record

xWIN Finance
Audits2 audits by 1 firmLast audit Jun 2023, by CertiK.
Critical findingsNo open critical findingsAcross the 2 reports, 2 critical findings were reported. Each is marked fixed by the firm that reported it.
IncidentIncident 24 Jun 2021Source: De.Fi incident database.
Open xWIN Finance’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us