MESSIER security record
As of 3 Nov 2026, MESSIER has 4 audit reports by 3 security firms on Trustblock; the latest is by HashEx, dated 5 Aug 2023. Those reports list no open critical findings. It also holds 11 deployed contracts on 1 chain.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Audits4
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Messier | Security firm: HashEx | Date: | Scope: 1 address on Ethereum | No open critical findings | Open · hashex.org |
| Messier - Audit | Security firm: CertiK | Date: | Scope: 2 addresses on Ethereum | No open critical findings | Open · skynet.certik.com |
| Virgo | Security firm: SolidProof | Date: | Scope: Files named in the report | No open critical findings | Open · IPFS |
| Messier | Security firm: SolidProof | Date: | Scope: 8 addresses on Ethereum | No open critical findings | Open · IPFS |
Findings47
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 2 |
| Medium | 0 | 0 | 8 |
| Low | 16 | 2 | 18 |
HighA user could sign a proposal for multiple timesMessier - Audit · CertiK · 23 May 2023Fixed
In the `signOnProposal()` function, users can only sign a proposal once due to the `notSigner(proposalIndex)` modifier, which checks whether `_storeSigner[msg.sender][_proposalIndex] == false`. Therefore, the `_storeSigner[msg.sender][_proposalIndex] = true` code should be used for each signing process. However, the contract uses `_storeSigner[msg.sender][signersNum] = true;`, which allows a user to sign a proposal multiple times.
Open the reportHighCentralization Related Risks in `ProposalCheckOutMessier - Audit · CertiK · 23 May 2023Fixed
In the contract `Dao` the role `ORACLE` has authority over the functions below. - function `ProposalCheckOut`: to execute a proposal according to the `ProposalType`. Any compromise to the `ORACLE` account may allow the hacker to take advantage of this authority.
Open the reportMediumIndistinguishable feesMessier · HashEx · 5 Aug 2023Fixed
The report gives no description here.
Open the reportMediumLack of Quorum RestrictionMessier - Audit · CertiK · 23 May 2023Fixed
In the function `CheckOutVote()`, the voting result is only based on the number of YES and NO votes without considering the total amount of votes, namely the quorum. As a result, the vote could be passed with only one YES vote.
Open the reportMediumLogical issue in function `changeState()`Messier - Audit · CertiK · 23 May 2023Fixed
The logic in the `changeState` function is incomplete and incorrect. Specifically, the `VoteOnProposal` function can only be invoked in the `QUEUED` state, but there is no mechanism to transition to or from that state: 1. The `CREATED` state can only be changed to `FAILED`. 2. There is currently no mechanism in place to transition from the `QUEUED` state to the `VOTING` state. 3. It is not possible to change the state to any value other than `CREATED` or `VOTING` once the proposal has entered either of these states. ```solidity = 703 function changeState(State _state,uint _proposalIndex) public OnlyOracle returns(bool){ if(proposals[_proposalIndex].activeState == State.CREATED){ if(_state == State.FAILED){ proposals[_proposalIndex].activeState = _state; }else{ revert("You can not change whatever you want"); } }else if(proposals[_proposalIndex].activeState == State.VOTING){ (uint YES,uint NO,State s) = CheckOutVote(proposalIndex); if(NO>YES){ proposals[_proposalIndex].activeState =State.FAILED; }else{ proposals[_proposalIndex].activeState =State.READY; } } ```
Open the reportMediumLogical issue on the voting systemMessier - Audit · CertiK · 23 May 2023Fixed
The `oracle` role has the ability to directly execute a proposal by calling `OracleNext()` regardless of the result of the voting process, which has the potential to render the entire voting system invalid.
Open the reportMediumLogical issue when processing the `queue_Ids` inMessier - Audit · CertiK · 23 May 2023Fixed
The following code snippets in the `ProposalCheckOut()` function is incorrect: ```solidity if (queue_Ids[_Index] == _idQ) { queue_Ids[_Index] = queue_Ids[_Index]; queue_Ids.pop(); ``` , for the `queue_Ids[_Index] = queue_Ids[_Index];` is redundant, it should be `queue_Ids[_Index] = queue_Ids[queue_Ids.length - 1];` to implement the design.
Open the reportMediumMissing Receive FunctionMessier - Audit · CertiK · 23 May 2023Fixed
There is no `receive()` or `fallback()` function in the Dao.sol, so this contract cannot receive ETH.
Open the reportMediumThe `CloseProposal()` will not workMessier - Audit · CertiK · 23 May 2023Fixed
The `CloseProposal()` function cannot be called because a vote can only be in the `State.CREATED` or `State.EXECUTED` state according to the code. Additionally, changing the state to `State.FAILED` has no effect as there is no state check on `VoteOnProposal()`, meaning that the voting process cannot be stopped.
Open the reportMediumWrong state checkMessier - Audit · CertiK · 23 May 2023Fixed
According to the logic of the function `ProposalNext()`, the state check in `ProposalCheckOut()`, which is `if(proposal.activeState ==State.QUEUED)`, should be modified as `if(proposal.activeState ==State.RUNNING)`, or the `ProposalNext()` would be reverted.
Open the reportShow 10 more
LowAbsence of event emission in setSwapEnabled() functionMessier · HashEx · 5 Aug 2023Fixed
The report gives no description here.
Open the reportLowAdding liquidityMessier · HashEx · 5 Aug 2023Fixed
The report gives no description here.
Open the reportLow`Initializable` is Not ImportedMessier - Audit · CertiK · 23 May 2023Fixed
The `Initializable` contract is inherited but not imported.
Open the reportLowLack of check on `proposal.date`Messier - Audit · CertiK · 23 May 2023Fixed
If the proposal has a time limit, the contract should verify that the current time is within the voting period before calling `VoteOnProposal()`.
Open the reportLowMissing Emit EventsMessier - Audit · CertiK · 23 May 2023Fixed
There should always be events emitted in the sensitive functions that are controlled by centralization roles.
Open the reportLowMissing Error MessagesMessier - Audit · CertiK · 23 May 2023Fixed
The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.
Open the reportLowMissing Zero Address ValidationMessier - Audit · CertiK · 23 May 2023Fixed
Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=160 ORACLE = _oracle; ``` - `_oracle` is not zero-checked before being used. --- ```solidity=161 _M87 = _m87; ``` - `_m87` is not zero-checked before being used. --- ```solidity=188 _supernova = _fb; ``` - `_fb` is not zero-checked before being used.
Open the reportLowPotential Sandwich AttacksMessier - Audit · CertiK · 23 May 2023Fixed
A sandwich attack may happen when an attacker observes a transaction swapping tokens or adding liquidity without setting restrictions on slippage or minimum output amount. The attacker can manipulate the exchange rate by frontrunning (executing before the target) a transaction to purchase one of the assets and make profits by back running (executing after the target) a transaction to sell the asset. The following function is called without setting restrictions on slippage or minimum output amount, so transactions triggering the function are vulnerable to sandwich attacks, especially when the input amount is large: - `IUniswapV2Router(UNISWAP_V2_ROUTER).swapExactTokensForETHSupportingFeeOnTransferTokens()` in `swapTokensForEth()`
Open the reportLowRedundant `Bridge` modifierMessier - Audit · CertiK · 23 May 2023Fixed
The `Bridge` modifier verifies whether the `_hsh` parameter is equal to the `_Hash` value. However, since the `_hsh` is always passed in as the `_Hash` parameter and is not set by the function caller, the modifier becomes redundant.
Open the reportLowRedundant `CLASSIC_MAX` and `CLASSIC_MIN`Messier - Audit · CertiK · 23 May 2023Fixed
The `CLASSIC_MAX` and `CLASSIC_MIN` is not used anywhere in the contract, hence they are redundant.
Open the reportShow 8 more
LowRedundant `ProposalCheckOut()`Messier - Audit · CertiK · 23 May 2023Fixed
The private function `ProposalCheckOut()`, which verifies and executes the result of a proposal, is redundant as it is not utilized anywhere in the contract.
Open the reportLowRedundant codeMessier - Audit · CertiK · 23 May 2023Fixed
In consideration of the functionality of the `changeState()` function and its capacity to modify a proposal's state at will, it appears unnecessary to use the `CloseProposal()` function to change the proposal state to `FAILED`. Additionally, the `failedChecker` modifier has also been considered redundant since every function that utilizes this modifier already incorporates an `atState` check.
Open the reportLowToo Many DigitsMessier - Audit · CertiK · 23 May 2023Fixed
Literals with many digits are difficult to read and review. ```solidity=164 CLASSIC_DEF = 8700000000000000000; //wei 8.7 ``` --- ```solidity=165 DOUBLE_DEF = 17400000000000000000; //wei 17.4 ``` --- ```solidity=166 CLASSIC_MIN = 870000000000000000; //wei 0.87 ``` --- ```solidity=167 DOUBLE_MIN = 8700000000000000000; //wei 8.7 ``` --- ```solidity=168 CLASSIC_MAX = 87000000000000000000; //wei 8.7 ``` --- ```solidity=169 DOUBLE_MAX = 26100000000000000000; //wei 26.1 ``` --- ```solidity=170 FULLCYCLE_MAX = 87000000000000000000; //wei 87 ETH ```
Open the reportLowTypoMessier - Audit · CertiK · 23 May 2023Fixed
The `persentage` should be `percentage`.
Open the reportLowUnchecked ERC-20 `transfer()`/`transferFrom()` CaMessier - Audit · CertiK · 23 May 2023Fixed
The return value of the transfer()/transferFrom() call is not checked. ```solidity=764 IERC20Upgradeable(_token).transfer( address(_supernova), getfromtoken ); ``` --- ```solidity=803 IERC20Upgradeable(_token).transfer(address(0xdead), getfromtoken); ```
Open the reportLowUnlocked Compiler VersionMessier - Audit · CertiK · 23 May 2023Fixed
The contract cited has an unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to ambiguity when debugging, as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.
Open the reportLowUnused private functionMessier - Audit · CertiK · 23 May 2023Fixed
The function `swapTokenForToken` is private but never used in the contract, hence it is redundant.
Open the reportLowUnused Return VariableMessier - Audit · CertiK · 23 May 2023Fixed
```solidity=390 returns (bool) ``` - The function `ProposalCheckOut` implicitly returns a default value. --- ```solidity=446 returns (bool) ``` - The function `sendToExecution` implicitly returns a default value. --- ```solidity=505 returns (bool) ``` - The function `ProposalNext` implicitly returns a default value. --- ```solidity=713 ) internal Bridge(_hsh) returns (bool) { ``` - The function `execute_oneProposal` implicitly returns a default value. --- ```solidity=791 ) internal Bridge(_hsh) returns (bool) { ``` - The function `execute_Cycle` implicitly returns a default value.
Open the reportContracts11
| Address | Chain | Source code |
|---|---|---|
| 0xe0cf9c69894e2cca7221a5d1db2f867ece64b08c | Chain: Ethereum | Source code: Verified source |
| 0x2b653f343e11ded7daef015aa3034594c3194dd4 | Chain: Ethereum | Source code: Verified source |
| 0x80122c6a83c8202ea365233363d3f4837d13e888 | Chain: Ethereum | Source code: Verified source |
| 0xeb3c2460143c0d1101318faa81546e4b3fa17122 | Chain: Ethereum | Source code: Verified source |
| 0xdfe8fb8faa4b4bb9f8d0a8135a1706104b3681c6 | Chain: Ethereum | Source code: Verified source |
| 0x85c2eebab92ef47289f9f05ee29b273e5fa122c0 | Chain: Ethereum | Source code: Verified source |
| 0xeb8878c6455f2c979e11fab5dc92768afc13c462 | Chain: Ethereum | Source code: Verified source |
| 0x615a2ba5e4494a2958cd377a97490bbb66d70919 | Chain: Ethereum | Source code: Verified source |
| 0xb3b3206203109ff1dff8118386ea90ac834d6c77 | Chain: Ethereum | Source code: Verified source |
| 0xb2b01b38caa4004b17d880cbc6bd8a092ea17408 | Chain: Ethereum | Source code: Verified source |
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="messier"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us