5Ire

CertiK16 Nov 2023Files named in the report

CertiK reviewed 5ire on 16 Nov 2023: 8 findings, 0 critical; 6 marked fixed, 1 acknowledged, 1 open.

No open critical findings

Open the report Open 5ire’s security record

Report hosted on skynet.certik.com.

Statuses are the security firm’s own, from this report. Trustblock does not review code.

Findings8

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	1	2
Medium	0	0	1
Low	1	0	3

HighCentralized Control of Contract UpgradeFixed

The contract `FireErc20` is an upgradeable contracts, the admin has the authority to upgrade the contract. Any compromise to the admin account may allow a hacker to take advantage of this authority and change the implementation contract which is pointed by proxy and therefore execute potential malicious functionality in the implementation contract.

HighMinting Centralization RiskFixed

In the contract `FireErc20`, the role `_MINTER_ROLE` has the authority to mint an arbitrary amount of tokens to the `msg.sender`. Any compromise to the `_MINTER_ROLE` account may allow a hacker to take advantage of this authority and mint a huge amount of tokens to themselves. The hacker could sell those tokens and cause the token price to drop. ```solidity=37 function mint(uint256 amount) public onlyRole(_MINTER_ROLE) returns (bool) { _mint(_msgSender(), amount); return true; } ```

MediumUsing 1e16 as the `_INITIAL_SUPPLY`Fixed

It is noted that the `_INITIAL_SUPPLY` is set to `1500000000 * 1e16` and the decimal is `18`, we would like to confirm if current initial token amount align with the intended design.

LowDEFAULT_ADMIN_ROLE is not granted for any accountFixed

In the `ERC205ire_init()` function, it is noted that only `_MINTER_ROLE` is granted to the `_owner` and the `DEFAULT_ADMIN_ROLE` role is not assigned to any accounts. This implementation limits the management of privileged roles, as no accounts have the `DEFAULT_ADMIN_ROLE` role.

LowLack of Storage Gap in Upgradeable ContractFixed

There is no storage gap preserved in the logic contract. Any logic contract that acts as a base contract that needs to be inherited by other upgradeable children should have a reasonable size of storage gap preserved for the new state variable introduced by the future upgrades.

LowMissing Input ValidationFixed

In the function `ERC205ire_init()`: 1. The given input `_owner` and `_addresses` do not include a check for a zero address, which is recommended to ensure the validity of the addresses being used. 2. The given input `_distributionPercents` lacks a check to ensure that the sum of the distribution percentages equals the `_INITIAL_SUPPLY` value. This check is important to ensure that the initial token distribution is accurate and does not result in any discrepancies.