Ontact

CertiKRepository at commit cce2f62

CertiK reviewed OnTact on 3 Jan 2024: 6 findings, 0 critical; 4 marked fixed, 2 open.

No open critical findings
Open the reportOpen OnTact’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings6

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High201
Medium001
Low002
HighRisk of Loss due to Single Destination AddressFixed

The `unLock()` function in the `TokenLock` contract is designed to unlock tokens based on a predefined schedule and transfer them to a specified receiver. However, the function will transfer unlocked tokens to the wallet addresses defined in `TokenLockConst.CONST_RECEIVERS[_receiverIndex]` only. The unlocked tokens could be lost if the private key of the wallet address is compromised.

MediumInconsistency Between Transfer And TransferFrom LFixed

The function `transfer()` has the restriction while the function `transferFrom()` does not, which creates an inconsistency between them. This will cause the problem that the user cannot transfer tokens to address(this) by calling `transfer()`, however, he/she can still call `transferFrom()` to transfer the tokens to address(this)`

LowBuild FailureFixed

Following parts should be fixed to resolve the building failure: 1. In line 110 of `erc20/ERC20.sol`, `Address(this)` should be `address(this)` 2. In all files with such import statement: `import {IERC20} from "IERC20.sol";`, the imported path should be changed to either a relative path like `import {IERC20} from "./IERC20.sol";` or an absolute path.

LowVariables That Could Be Declared as ImmutableFixed

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (8)

  • https://github.com/infomeapps/OnTact-Contract/erc20/OnTact.sol at commit cce2f62970b324705391ba1ffcb9b1570b42b270
  • https://github.com/infomeapps/OnTact-Contract/mint/Context.sol at commit cce2f62970b324705391ba1ffcb9b1570b42b270
  • https://github.com/infomeapps/OnTact-Contract/mint/Ownable.sol at commit cce2f62970b324705391ba1ffcb9b1570b42b270
  • https://github.com/infomeapps/OnTact-Contract/erc20/Context.sol at commit cce2f62970b324705391ba1ffcb9b1570b42b270
  • https://github.com/infomeapps/OnTact-Contract/mint/TokenLock.sol at commit cce2f62970b324705391ba1ffcb9b1570b42b270
  • https://github.com/infomeapps/OnTact-Contract/mint/TokenLockConst.sol at commit cce2f62970b324705391ba1ffcb9b1570b42b270
  • https://github.com/infomeapps/OnTact-Contract/erc20/draft-IERC6093.sol at commit cce2f62970b324705391ba1ffcb9b1570b42b270
  • https://github.com/infomeapps/OnTact-Contract/erc20/ERC20.sol at commit cce2f62970b324705391ba1ffcb9b1570b42b270

Part of OnTact’s security record

OnTact
Audits1 audit by 1 firmLast audit Jan 2024, by CertiK.
Critical findingsNo open critical findingsIn 1 report.
Open OnTact’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us