CleanCarbon.io security record
As of 3 Nov 2026, CleanCarbon.io has 2 audit reports by 2 security firms on Trustblock; the latest is by CertiK, dated 18 Sep 2023. Those reports list no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits2
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| CleanCarbon | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| CleanCarbon | Security firm: HashEx | Date: | Scope: Repository at commit master | No open critical findings | Open · hashex.org |
Findings54
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 11 | 1 | 1 |
| Medium | 5 | 0 | 1 |
| Low | 25 | 0 | 10 |
High100% feesCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportHighDeposit index is not checkedCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportHighexcludeFromRFI() abuseCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportHighIndexation problemCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportHighNot enough requiresCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportHighOwner access to the fundsCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportHighOwner can change token contract addressCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportHighOwner overpowerCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportHighRFI supportCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportHighRFI supportCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportShow 10 more
HighVesting schedule governance is centralizedCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportMediumRewards For `teamDev` Can Be Released EarlyCleanCarbon · CertiK · 18 Sep 2023Open
The `latestUpdateForTeamDev` in the `constructor()` can be set to any initial value. In particular, it can be set to a value that is not a multiple of `secondsPerMonth`, which allows for rewards to be released earlier than expected. In addition, `latestUpdateForTeamDev` is set in the `constructor()` with no upper or lower bounds. If this value is set to a low value accidentally, then it is possible for the `teamDev` to be rewarded the `maxTokenForDev` as soon as the contract is deployed. If this value is set to a value much higher than the `block.timestamp`, then the `teamDev` may not be eligible for rewards when they should.
Open the reportMediumBlocked transfersCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportMediumConfusing onlyManager() modifierCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportMediumExpensive callbackCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportMediumUser's input checkCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportLow`changeAdminRole()` RestrictionCleanCarbon · CertiK · 18 Sep 2023Open
The function `changeAdminRole()` can only be called by the `ADMIN`. However, the `DEFAULT_ADMIN_ROLE` can still grant and revoke the `ADMIN` role through the `grantRole()` and `revokeRole()` functions as it is the admin of all roles by default. This in particular allows there to be multiple addresses with the `ADMIN` role.
Open the reportLowCalling Void ConstructorCleanCarbon · CertiK · 18 Sep 2023Open
Calling an undefined parent constructor has no effect. The `constructor()` of the contracts `AirdropCarbonv2`, `CarboTokenv2`, and `StakingCarbon` all call `AccessControl()` which does not have a defined constructor.
Open the reportLowCan Use `delete` To Save GasCleanCarbon · CertiK · 18 Sep 2023Open
When a user calls `unstake()`, the `userStateStorage[msg.sender]` is set back to the default values of `0` by hand. This can instead be done using the `delete` operator saving around 4007 gas on deployment and 63 gas on each function call. See the documentation on `delete` here: [Solidity Delete Documentation](https://docs.soliditylang.org/en/v0.8.17/types.html?highlight=delete#delete:~:text=after%20the%20change.-,delete,only%20reset%20a%20itself%2C%20not%20the%20value%20it%20referred%20to%20previously.,-//%20SPDX%2DLicense%2DIdentifier).
Open the reportLowMinting To `address(1)`CleanCarbon · CertiK · 18 Sep 2023Open
On contract deployment `80_000_000` tokens are minted to `address(1)`, which is a null address and will cause those tokens to be unusable. As the tokens are not available, they should not be accounted for in the total supply. However, as they are minted to `address(1)`, they will be included in the total supply of the token.
Open the reportShow 10 more
LowPossibly Inefficient Memory ParameterCleanCarbon · CertiK · 18 Sep 2023Open
One or more parameters with `memory` data location are never modified in their functions and those functions are never called internally within the contract. Thus, their data location can be changed to `calldata` to avoid the gas consumption copying from calldata to memory. ```solidity=54 function addStakingPayload(StakingOptions memory payload) ``` `addStakingPayload` has memory location parameters: `payload`. This change will increase the deployment cost by around `7813` gas, while saving around `61` gas on each function call.
Open the reportLowVariables That Could Be Declared as ImmutableCleanCarbon · CertiK · 18 Sep 2023Open
The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.
Open the reportLowChecks for priceCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportLowERC20 transfersCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportLowEvents for ownable functionsCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportLowFloating PragmaCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportLowFloating PragmaCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportLowFloating PragmaCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportLowGas optimizationCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportLowGas optimizationCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportShow 10 more
LowGas optimizationCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportLowGas optimizationsCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportLowGas optimizationsCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportLowMath roundingCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportLowNative token transferCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportLowNo check for zero addressCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportLowNo length info for schedules variableCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportLowNot enough eventsCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportLowNot enough eventsCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportLowPossible gas limit problemCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportShow 1 more
LowSwaps without slippage and deadline controlCleanCarbon · HashEx · 23 Apr 2022Open
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="cleancarbon"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us