As of 3 Nov 2026, Chancer has 1 audit report on Trustblock, by CertiK, dated 30 May 2023. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Chancer - Audit | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 3 | 0 | 2 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 1 | 3 |
The function `rescueERC20()` can be called to transfer any ERC20 tokens to any address. According to the function name, this function is supposed to send trapped ERC20 tokens. Hence a validation is necessary to prevent the owner transfer the sale token balance of CHRPresale contract to an arbitrary user: `_tokenAddress != saleToken`.
Open the reportIn the contract CHRToken, the role `owner` has the authority over the following function: - `mint()` Any compromise to the `owner` account may allow the hacker to take advantage of this and mint tokens.
Open the reportIn line 198, the `amount` is multiplied by 1e18. Consequently, the auditors presume that the input parameters `_amount` used in both `buyWithBnb` and `buyWithBUSD` functions, also lack decimal places. This particular design choice gives rise to an issue in the price calculation process. The variable `priceInBUSD` is computed without considering any decimals and subsequently utilized in the calculation of `priceInBNB`. Notably, the `priceInBNB` solely undergoes multiplication by 1e8 and thus lacks decimal places altogether. Consequently, if the value of `priceInBNB` does not exceed 1 BNB, it will become 0 since it is type uint256. Furthermore, in line 166, the calculation involves subtracting `priceInBNB` from `msg.value`. Considering that the `msg.value` contains 18 decimal places, this calculation would yield an incorrect result. Additionally, the comments in lines 227-228 refers that `priceInBNB` has a decimal of 18 and `priceInBUSD` has a decimal of 6, which are inconsistent with the implementation. `priceInBUSD` also shouldn't have a decimal of 6.
Open the reportThe comments for `_limitPerStage ` and `_pricePerStage` are not correct.
Open the reportThere should always be events emitted in the sensitive functions that are controlled by centralization roles.
Open the reportThere are no limits on `claimStartTime` and `saleEndTime` setting in the constructor, function `configureSaleTimeframe`, and function `configureClaim`. Due to the lack of documentation, the auditors are not sure if the system design allows the `claimStartTime` to be smaller than `saleEndTime`. If users are allowed to buy tokens after `claimStartTime`, we recommend replacing the `hasClaimed[_msgSender()]` check to `purchasedTokens[_msgSender()] = 0` in function `claim`. Otherwise, we recommend adding checks to ensure `saleEndTime` will always be smaller than `claimStartTime`.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="chancer"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us