Fenix security record
As of 3 Nov 2026, Fenix has 1 audit report on Trustblock, by CertiK, dated 13 Apr 2023. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
Findings8
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 0 | 7 |
MediumUnclear Condition Check in `calculateEarlyPayout(Fenix · CertiK · 13 Apr 2023Fixed
In the function `calculateEarlyPayout()`, the following check is satisfied in the case where `block.timestamp < stake.startTs` *and* the status is not active. ```solidity=330 if (block.timestamp < stake.startTs && stake.status == Status.ACTIVE) revert FenixError.StakeNotStarted(); ``` However, if the `stake.status` is not set to `ACTIVE` while `block.timestamp` is less than `stake.startTs`, then this check will pass and the function will revert due to underflow at the subsequent line without an error message: ```solidity=332 uint256 termDelta = block.timestamp - stake.startTs; ``` The only way in which the `block.timestamp` is strictly less than the `stake.startTs` value is if a user directly inputs a stake that was not created by the contract. Moreover, the check that the `stake.status` is active appears to prevent this check from working correctly.
Open the reportLowContract Does Not Follow EIP-165 for IERC165 ImplFenix · CertiK · 13 Apr 2023Fixed
The contract `Fenix` inherits `IERC165`, but does not follow [IEP165](https://eips.ethereum.org/EIPS/eip-165#how-a-contract-will-publish-the-interfaces-it-implements) recommendation : \ `supportsInterface()` returns false when `interfaceID` is `0x01ffc9a7`. ---- It should also be noted that the contract could return `true` also for the `interfaceID` of `ERC20`.
Open the reportLowDouble Emission of EventsFenix · CertiK · 13 Apr 2023Fixed
In the function `endStake()`, the event `EndStake` is emitted twice with differing staking information.
Open the reportLowEvent `Redeemed` is Inherited but Never EmittedFenix · CertiK · 13 Apr 2023Fixed
The event `Redeemed` is inherited from `IBurnRedeemable` but never emitted in the contract.
Open the reportLowHardcoded AddressFenix · CertiK · 13 Apr 2023Fixed
The `XEN_ADDRESS` is hardcoded in `Fenix.sol` and does not correspond to a contract address on a mainnet environment. The address exists on BscScan testnet at [**https://testnet.bscscan.com/address/0xcb99cbfa54b88cda396e39abac010dfa6e3a03ee**](https://testnet.bscscan.com/address/0xcb99cbfa54b88cda396e39abac010dfa6e3a03ee), however, the contract is a BEP20 contract that appears incompatible with this implementation, since it does not possess functionality to call `onTokenBurned()` and does not have a public `burn()` function.
Open the reportLowSolidity Version Not RecommendedFenix · CertiK · 13 Apr 2023Fixed
`0.8.19` versions of solidity may be too recent. New versions could introduce bugs that will be corrected later.
Open the reportLowTypoFenix · CertiK · 13 Apr 2023Fixed
In the cited location, the word "calculate" is misspelled as `calcualte`.
Open the reportLowUnnecessary Import of `Context.sol`Fenix · CertiK · 13 Apr 2023Fixed
The contract `Fenix` imports and inherits `Context.sol` from `OpenZeppelin`. This contract is already imported in `ERC20.sol`.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="fenix"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us