Celer Network security record
As of 21 Oct 2026, Celer Network has 3 audit reports by 2 security firms on Trustblock; the latest is by PeckShield, dated 15 Feb 2023. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits3
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Celer: Celer MultiBridge audit | Security firm: PeckShield | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Celer Layer2 Finance v2 | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| Celer Network | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
Findings73
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 30 | 0 | 43 |
Low(Limited) Trust Issue Of Admin KeysCeler: Celer MultiBridge audit · PeckShield · 15 Feb 2023Fixed
The report gives no description here.
Open the reportLowSuggested Adherence Of Checks-Effects-Interactions PatternCeler: Celer MultiBridge audit · PeckShield · 15 Feb 2023Fixed
The report gives no description here.
Open the reportLowIneffectual statementCeler Layer2 Finance v2 · CertiK · 25 Jun 2021Fixed
The private `_revertBlock` function in the `RollupChain` contract contains an ineffectual statement in a while loop at L687.
Open the reportLowMissing visibility specifiersCeler Layer2 Finance v2 · CertiK · 25 Jun 2021Fixed
The linked lines have missing visibility specifiers, which may result in undesired behavior for sharing between contracts.
Open the reportLowMixed usage of require and returning error messagCeler Layer2 Finance v2 · CertiK · 25 Jun 2021Fixed
The external `disputeTransition` function in the `TransitionDisputer` contract contains mixed usage of require statements and returning error messages. In the event of returning an error message, no actual reversion is happening.
Open the reportLowState variables can be declared immutableCeler Layer2 Finance v2 · CertiK · 25 Jun 2021Fixed
The state variable declared on the linked lines are mutable, yet are only ever assigned to in the contract's constructor.
Open the reportLowUnlocked solidity version pragmaCeler Layer2 Finance v2 · CertiK · 25 Jun 2021Fixed
The contract specifies an unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.
Open the reportLowUnnecessary abicoder v2 pragmaCeler Layer2 Finance v2 · CertiK · 25 Jun 2021Fixed
The linked line explicitly specifies `pragma abicoder v2`, which is unnecessary due to the feature being enabled by default in Solidity v0.8.0 and above.
Open the reportLowUnnecessary fallback functionCeler Layer2 Finance v2 · CertiK · 25 Jun 2021Fixed
The fallback function in the `RollupChain` contract is unnecessary as it allows nonstandard function selectors and does not contain any actual logic.
Open the reportLowUnnecessary local variable declarationCeler Layer2 Finance v2 · CertiK · 25 Jun 2021Fixed
The linked local variable declaration is unnecessary and its value can be supplied to the call to `blocks.push` on L264.
Open the reportShow 10 more
Low`require` statement can be substituted with a funCeler Network · CertiK · 23 Oct 2020Fixed
The require statement on the aforementioned line asserts that the new commission rate should be less-than-orequal to the already set commission rate. However, the function name nonIncreaseCommissionRate implies that the new rate should be less-than the already set rate. Also, the execution of the function will be ineffectual and nonstate changing if the provided rate and time in the parameters is same as the already set values
Open the reportLow`require` statement can be substituted with a modCeler Network · CertiK · 23 Oct 2020Fixed
The require statements on the aforementioned lines have the same predicates and error message. The require statement can be converted into a modifier to avoid code duplication and increase legibility of the code
Open the reportLow`TODO` commentCeler Network · CertiK · 23 Oct 2020Fixed
The aforementioned line has a TODO which we advise that be removed from code.
Open the reportLowCan be declared constant and use uint256 insteadCeler Network · CertiK · 23 Oct 2020Fixed
The variable declaration on the aforementioned line be changed to a constant to save gas cost associate with storage slot. Additionaly, the type of declaration is uint which is an alias uint256 . A clean coding practice is to use complete type name of uint256 instead of alias uint .
Open the reportLowConfusing Variable NameCeler Network · CertiK · 23 Oct 2020Fixed
The variable name yesVotes on the aforementioned line implies that it represents the count of yes votes yet it specifies the amount of total stakes represented by validators with yes votes. The variable name should reflect the staking amount it represents.
Open the reportLowFunction vibility can be changed to externalCeler Network · CertiK · 23 Oct 2020Fixed
The functions on the aforementioned lines are never called from within the contract and hence their visibilities can be changed to external .
Open the reportLowFunction vibility can be changed to externalCeler Network · CertiK · 23 Oct 2020Fixed
The functions on the aforementioned lines are never called from within the contract and hence their visibilities can be changed to external .
Open the reportLowGrammar ErrorCeler Network · CertiK · 23 Oct 2020Fixed
The aforementioned line has a grammar error where it says Delegators has to wait .
Open the reportLowIncorrect ComparisonCeler Network · CertiK · 23 Oct 2020Fixed
The require statement on the aforementioned line checks against that the servicePool should always be greater than newServiceReward which will result in not being able to claim all of funds specified by servicePool .
Open the reportLowIneffectual Library import and declarationCeler Network · CertiK · 23 Oct 2020Fixed
The library ECDSA is imported and declared but is never used in the contract. The import and declaration on the aforementioned lines can be safely removed.
Open the reportShow 10 more
LowInefficient CodeCeler Network · CertiK · 23 Oct 2020Fixed
The code on the aforementioned lines can be optimized by the use of a local variable and a single _updateDelegatedStake call to reduce the bytecode footprint of the contract.
Open the reportLowInefficient CodeCeler Network · CertiK · 23 Oct 2020Fixed
The code on the aforementioned lines only effectually executes when the function _updateCommissionRate is called from confirmIncreaseCommissionRate as part of announced rate update. When the function _updateCommissionRate is called from nonIncreaseCommissionRate , the execution of aforementioned lines is ineffectual and hence costs unwanted gas. The aforementioned lines can be moved to confirmIncreaseCommissionRate after the call to _updateCommissionRate so that the execution of nonIncreaseCommissionRate does not execute the code on aforementioned lines.
Open the reportLowInefficient usage of SafeMathCeler Network · CertiK · 23 Oct 2020Fixed
The Addition and Subtraction operations on the aforementioned lines do not depend upon the values received outside of the contract and hence their chances of oveflowing or underflowing are neglibible considering a uint256 can store a large enough value for their use cases. These operations can be safely performed without SafeMath which will save the additional gas cost associated with Safe Addition and Safe Subtraction without comprising the security of the contract.
Open the reportLowInefficient use of local variableCeler Network · CertiK · 23 Oct 2020Fixed
The declaration of local variable on the aforementioned line is inefficient as the variable is never used at more than one places. The gas cost associated with local variable declaration can be saved by using the initialization part directly in place of the declared local variable.
Open the reportLowInefficient use of local variableCeler Network · CertiK · 23 Oct 2020Fixed
The declaration of local variable on the aforementioned line is inefficient as the variable is never used at more than one places. The gas cost associated with local variable declaration can be saved by using the initialization part directly in place of the declared local variable.
Open the reportLowInefficient use of local variableCeler Network · CertiK · 23 Oct 2020Fixed
The declaration of local variables on the aforementioned line is inefficient as any variable is never used at more than one place. The gas cost associated with local variable declaration can be saved by using the initialization part directly in place of the declared local variable
Open the reportLowInexistence of reason in Require StatementsCeler Network · CertiK · 23 Oct 2020Fixed
The require statements on the aforementioned lines do not specify reason string . The reason string s should be provided to require statements to aid debugging and readability of the code.
Open the reportLowMissing check for the valid inputCeler Network · CertiK · 23 Oct 2020Fixed
The functions on the aforementioned lines has parameter _vote of type VoteType . The code does not have a check against a VoteType value of VoteType.UnVoted , which if passed would successfully execute the transaction without changing the state of the vote
Open the reportLowPotentially Incorrect ComparisonCeler Network · CertiK · 23 Oct 2020Fixed
The require statement on the aforementioned line asserts that block.number should be greater than the earliestBondTime for the earliest bond time to arrive. However, intiuitively when the block.number is equal to earliestBondTime then it should be considered that the bond time has arrived.
Open the reportLowPotentially Incorrect Error MessageCeler Network · CertiK · 23 Oct 2020Fixed
The error message on the aforementioned line has a potentially incorrect error message Fail to check validator sigs which implies that the operation of validating signatures itself failed to initiate. The require statement throws when the signatures are invalid and as such the error message should highlight it.
Open the reportShow 10 more
LowPotentially Incorrect ImplementationCeler Network · CertiK · 23 Oct 2020Fixed
The function confirmSidechainProposal does not handle the assignment of deposited funds when a sidechain proposal does not pass. In the function confirmParamProposal , when a Param proposal does not pass, the deposited funds are assigned to miningPool but no such assignment of funds is implemented in confirmSidechainProposal .
Open the reportLowRedundant initialization with default valueCeler Network · CertiK · 23 Oct 2020Fixed
The aforementioned line declares variablesof type bool and initialize it with false . In Solidity, all un-initialized variables have a default value which for the bool variable is false , hence the initialization part is redundant and can be removed.
Open the reportLowRedundant initialization with default valueCeler Network · CertiK · 23 Oct 2020Fixed
The aforementioned lines declare variables of type uint256 and initialize it with 0 . In Solidity, all un-initialized variables have a default value which for the uint256 variable is 0 , hence the initialization part is redundant and can be removed.
Open the reportLowRedundant State VariableCeler Network · CertiK · 23 Oct 2020Fixed
The variable celerToken on the aforementioned line is initialized with the same address as governToken variable in the parent Govern contract on L71 . As both the variables are initialized with the same ERC-20 token address, one of them can removed to save gas costs associated with additional storage slot and to avoid the duplicate code to achieve code legibility.
Open the reportLowSpelling ErrorCeler Network · CertiK · 23 Oct 2020Fixed
The aforementioned line has a spelling error for misbehaviour
Open the reportLowSpelling ErrorCeler Network · CertiK · 23 Oct 2020Fixed
The aforementioned line has a spelling error for the word creation .
Open the reportLowSpelling ErrorCeler Network · CertiK · 23 Oct 2020Fixed
The comment on the aforementioned line has a spelling error in the word Owner .
Open the reportLowSubstitution of require calls with ModifierCeler Network · CertiK · 23 Oct 2020Fixed
The require statements on the aforementioned lines can be converted to a modifier to avoid code duplication and increase legibility of the code.
Open the reportLowThe comment on the aforementioned line has spelliCeler Network · CertiK · 23 Oct 2020Fixed
The comment on the aforementioned line has spelling error for the word Owner .
Open the reportLowUnlocked Compiler VersionCeler Network · CertiK · 23 Oct 2020Fixed
The contracts have unlocked compiler versions. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one
Open the reportShow 3 more
LowUsage of ether instead of Decimals MultiplierCeler Network · CertiK · 23 Oct 2020Fixed
The modifier usage on the aforementioned passes minimum of token as 1 CELR . The decimals multiplier used is ether global variable which represents 18 decimals. Although, it is functionally correct but we advise that actual decimals multiplier of the token be used instead of ether global variable for better readability of the code.
Open the reportLowUsage of storage Variable Instead of memoryCeler Network · CertiK · 23 Oct 2020Fixed
The local variables on the aforementioned lines are declared as storage yet no write operations are performed. The usage of local storage variables is optimal in read operations only when the count of read operations is less than 4. As both of the aforementioned local storage variables perform more than 3 read operations, their data location can be changed to memory as it costs significantly less gas to read from memory . Although, the usage of memory data location will copy the data to memory but it is still cheaper than to make several read operations on storage .
Open the reportLowVariable not named in camelCaseCeler Network · CertiK · 23 Oct 2020Fixed
The state variable DPoSContract of type IDPoS is not named in camelCase which violates the best coding practices of Solidity.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="celer-network"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us