CertiK reviewed Fracton Protocol on 30 Jan 2023: 9 findings, 0 critical; 2 acknowledged, 7 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 0 |
| Medium | 0 | 1 | 0 |
| Low | 7 | 0 | 0 |
The `public` functions `multiTransfer()`, `transferFrom()`, and `excludeFromFee()` are never called by the contract and could be declared as `external`.
The contract is serving as the underlying entity to interact with one or more third party protocols. The scope of the audit treats third party entities as black boxes and assume their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. The contract `FractonFFT` interacts with third party contract with `IFractonTokenFactory` interface via `_factory`.
The name of the variable should be `swap`, to keep it consistent with the comment in the require statement.
The `SafeMath` library is used unnecessarily. With Solidity compiler versions 0.8.0 or newer, arithmetic operations will automatically revert in case of integer overflow or underflow.
The modifier `onlyOwner()` is not used in the contract.
The magic number `10000` is used instead of a constant, which reduces the code readability.
The variable `_factory` assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.
| Address | Chain | Source code |
|---|---|---|
| 0x7a83…13150x7a83ff237e7870d8d6c3485920ebe654d2841315 | Chain: Ethereum | Source code: Verified source |
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us