Filmio

CertiK17 Mar 2023Files named in the report

Audit

CertiK reviewed Film.io (Filmio) on 17 Mar 2023: 33 findings, 5 critical; 29 marked fixed, 1 acknowledged, 3 open.

5 critical findings, fixed

Open the report Open Film.io’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings33

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	5
High	0	0	1
Medium	0	1	1
Low	3	0	22

LowDependency On Out-of-Scope Inherited ContractOpen

The contracts cited inherit from an out-of-scope contract, `ERC2771Recipient` which is imported through: ```solidity "@opengsn/contracts/src/ERC2771Recipient.sol" ``` The audit treats out-of-scope inheritances as black boxes and assumes their functional correctness. However, in the real world, the contract logic could be compromised and this may lead to lost or stolen assets. In addition, upgrades of out-of-scope contracts can also create severe impacts.

LowInconsistencies in updates to parameters of `ratiOpen

- In function `modifyRating()`, the rating can be updated, but the corresponding parameter `timestamp` for `ratingDetails[updateRatingIds]` is not updated alongside. - The function `modifyRating()` can also be called to give a rating even after `reviewGiven` is set to true. - Any user can call the function `addReview()` on a `prj_id` for which they assigned a nonzero `projectRating`, and the parameter `reviewGiven` will be updated to true, without necessarily having given a review. Please clarify if this is intended.

LowPurpose of `remark`Open

It is expensive for users to pay for storing strings. It may be difficult for a user to adequately express information through a string meant to be used as a remark.