CertiK reviewed CheckDot on 31 Aug 2023: 4 findings, 0 critical; 1 marked fixed, 1 acknowledged, 2 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 2 | 0 | 1 |
In the `_transfer()` function, the `_holdingTimes` of `sender` will be set to `block.timestamp`. In the case that the `recipient` is receiving tokens when it has no token balance prior to the transfer, the `_holdingTimes` of `recipient` will also be set to `block.timestamp`. There are some concerns regarding the setting of `_holdingTimes` during transfers. For example, the initial holder transfers 200 CDT to Alice, and then Alice transfers 100 CDT to Bob and 100 CDT to Carl, finally Bob transfers 50 CDT back to Alice. It is observed that the `_holdingTimes` of Alice is updated with each of the above transactions involving Alice and the value of `_holdingTimes` is overwritten during normal transfers. In the various scenarios, like the ones described above, the value of `_holdingTimes` could be interpreted to mean different things. Therefore, we would like to understand more about the use of `_holdingTimes` and confirm if the current implementation aligns with the intended design.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (6)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us