As of 3 Nov 2026, Etherice has 1 audit report on Trustblock, by CertiK, dated 7 Nov 2022. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Newest first
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 3 | 0 | 1 |
| Medium | 0 | 0 | 3 |
| Low | 6 | 0 | 18 |
The lack of `_duration` validation in the `fillLoan()` function allows to take a loan whose duration will be exceeded of `_stake.endDay`.
Open the reportA Participant can always win the lottery by calling `doDailyUpdate()`. To do this, the participant must: 1. Wait until the end of the day; 2. Place the highest bet; 3. Call `doDailyUpdate()` before anyone makes a big bet.
Open the reportThe `_loan` value is not updated before the check which causes the check of `_loan.filledBy` and `_loan.requestedBy` values to be incorrect.
Open the reportThe `calcTokenValue()` will not work if `currentDay` is not updated.
Open the reportThe event `BiggestBuyCompWinner` is emitted from `EthericeBiggestBuyFlat.sol`.
Open the reportCommented out code is redundant.
Open the reportInternal and private function names don't start with "_".
Open the reportPerforming integer division before multiplication truncates the low bits, losing the precision of calculation. ```solidity=897 uint256 _marketingTax = (_amount / _totalTax) * marketing_percentage; ``` --- ```solidity=898 uint256 _rewardsTax = (_amount / _totalTax) * rewards_percentage; ``` --- ```solidity=899 uint256 _buybackTax = (_amount / _totalTax) * buyback_percentage; ``` --- ```solidity=900 uint256 _buyCompTax = (biggestBuy_percent > 0) ? (_amount / _totalTax) * biggestBuy_percent : 0; ```
Open the reportThe magic number `1000` is used as fee denominator across different contracts.
Open the reportThe functions which are never called internally within the contract should have external visibility for gas optimization.
Open the reportIn the event `StakeSold` one of the fields is `price` but when filling the event in the function `buyStake()` use `_sellAmount`.
Open the reportThe `cancelStakeSellRequest()` function does not check that the value of `mapStakes[_stakeId].forSalePrice` is not zero, so it will emit event `CancelStakeSellRequest` even though there was no request.
Open the reportThe **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.
Open the reportAddresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=793 _stakingContract = _stakingCa; ``` - `_stakingCa` is not zero-checked before being used. ```solidity=333 _tokenContract = TokenContractInterface(_address); ``` - `_address` is not zero-checked before being used. ```solidity=240 _tokenContract = EthericeTokenInterface(_tokenAddress); ``` - `_tokenAddress` is not zero-checked before being used.
Open the reportA reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects.
Open the reportThe `_val` naming is not informative.
Open the reportThe aforementioned line has a TODO comment. It looks like there is uncompleted function according to the comment. If not, consider removing the redundant TODO comment. A good practice is that there is not TODO comment in product codes.
Open the reportThere is a typo in name `dayDivendPool`. Expected `dayDividendPool`.
Open the reportThe contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.
Open the reportThe whole structure will be retrieved from storage to memory yet only one field is needed.
Open the reportIt is not recommended to use Solidity's `transfer()` and `send()` functions for transferring Ether, since some contracts may not be able to receive the funds. Those functions forward only a fixed amount of gas (2300 specifically) and the receiving contracts may run out of gas before finishing the transfer. Also, EVM instructions' gas costs may increase in the future. Thus, some contracts that can receive now may stop working in the future due to the gas limitation.
Open the reportThe `fillLoan()` function uses the magic number `98` as development fees. The `buyStake()` function uses the magic number `90` as development fees.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="etherice"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us