CertiK reviewed OnTact on 3 Jan 2024: 6 findings, 0 critical; 4 marked fixed, 2 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 2 | 0 | 1 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 0 | 2 |
The `unLock()` function in the `TokenLock` contract is designed to unlock tokens based on a predefined schedule and transfer them to a specified receiver. However, the function will transfer unlocked tokens to the wallet addresses defined in `TokenLockConst.CONST_RECEIVERS[_receiverIndex]` only. The unlocked tokens could be lost if the private key of the wallet address is compromised.
The function `transfer()` has the restriction while the function `transferFrom()` does not, which creates an inconsistency between them. This will cause the problem that the user cannot transfer tokens to address(this) by calling `transfer()`, however, he/she can still call `transferFrom()` to transfer the tokens to address(this)`
Following parts should be fixed to resolve the building failure: 1. In line 110 of `erc20/ERC20.sol`, `Address(this)` should be `address(this)` 2. In all files with such import statement: `import {IERC20} from "IERC20.sol";`, the imported path should be changed to either a relative path like `import {IERC20} from "./IERC20.sol";` or an absolute path.
The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (8)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us