Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
# Compiler files
cache/
out/
lib/
bin/
Eliza-Chainlink-Functions/



# Ignores development broadcast logs
broadcast/



# Dotenv file
.env
173 changes: 88 additions & 85 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,142 +1,145 @@
# Aderyn Analysis Report
# 🧠 Final Report ![GitHub Language](https://img.shields.io/badge/language-Solidity-blue.svg) ![License](https://img.shields.io/badge/license-MIT-green.svg) ![Last Commit](https://img.shields.io/github/last-commit/your-username/your-repo.svg) ![Audit Status](https://img.shields.io/badge/audit-pending-yellow.svg)

This report was generated by [Aderyn](https://github.com/Cyfrin/aderyn), a static analysis tool built by [Cyfrin](https://cyfrin.io), a blockchain security company. This report is not a substitute for manual audit or security review. It should not be relied upon for any purpose other than to assist in the identification of potential security vulnerabilities.
# Table of Contents

- [Summary](#summary)
- [Files Summary](#files-summary)
- [Files Details](#files-details)
- [Issue Summary](#issue-summary)
- [Low Issues](#low-issues)
- [L-1: Unspecific Solidity Pragma](#l-1-unspecific-solidity-pragma)
- [L-2: PUSH0 Opcode](#l-2-push0-opcode)
- [L-3: Large Numeric Literal](#l-3-large-numeric-literal)
- [L-4: Internal Function Used Only Once](#l-4-internal-function-used-only-once)
- [L-5: State Change Without Event](#l-5-state-change-without-event)

---

# Summary
## Tech Stack

## Files Summary
* **Testing**: [Foundry](https://getfoundry.sh/)
* **Security Auditing**: [Slither](https://github.com/crytic/slither) + [CyfrinUp](https://github.com/Cyfrin/up)
---

| Key | Value |
| --- | --- |
| .sol Files | 1 |
| Total nSLOC | 107 |
## 🔗 References

📊 **HTML Coverage Report**
View detailed coverage analysis in the browser at:
[`contract/coverage-report/index.html`](contract/coverage-report/index.html)

## Files Details
---
## 📚 Table of Contents

| Filepath | nSLOC |
| --- | --- |
| src/GetGift.sol | 107 |
| **Total** | **107** |
- [📝 Summary](#-summary)
- [📁 Files Summary](#-files-summary)
- [📄 Files Details](#-files-details)
- [⚠️ Issue Summary](#-issue-summary)
- [🟡 Low Issues](#-low-issues)
- [L-1: Unspecific Solidity Pragma](#l-1-unspecific-solidity-pragma)
- [L-2: PUSH0 Opcode](#l-2-push0-opcode)
- [L-3: Large Numeric Literal](#l-3-large-numeric-literal)
- [L-4: Internal Function Used Only Once](#l-4-internal-function-used-only-once)
- [L-5: State Change Without Event](#l-5-state-change-without-event)
- [🔗 References](#-references)

---

## Issue Summary
## 📝 Summary

| Category | No. of Issues |
| --- | --- |
| High | 0 |
| Low | 5 |
### 📁 Files Summary

| 🗂️ Key | 📌 Value |
|--------------|----------|
| `.sol` Files | 1 |
| Total nSLOC | 107 |

# Low Issues
---

## L-1: Unspecific Solidity Pragma
### 📄 Files Details

Consider using a specific version of Solidity in your contracts instead of a wide version. For example, instead of `pragma solidity ^0.8.0;`, use `pragma solidity 0.8.0;`
| 📍 Filepath | 🔢 nSLOC |
|-------------------|----------|
| `src/GetGift.sol` | 107 |
| **Total** | **107** |

<details><summary>1 Found Instances</summary>
---

### ⚠️ Issue Summary

- Found in src/GetGift.sol [Line: 2](src/GetGift.sol#L2)
| ⚠️ Category | 🚨 No. of Issues |
|-------------|------------------|
| High | 0 |
| Low | 5 |

```solidity
pragma solidity ^0.8.19;
```
---

</details>
## 🟡 Low Issues

### L-1: 🔧 Unspecific Solidity Pragma

Using a specific Solidity version is recommended for better consistency and auditability.
Instead of:

## L-2: PUSH0 Opcode
```solidity
pragma solidity ^0.8.19;
````

Solc compiler version 0.8.20 switches the default target EVM version to Shanghai, which means that the generated bytecode will include PUSH0 opcodes. Be sure to select the appropriate EVM version in case you intend to deploy on a chain other than mainnet like L2 chains that may not support PUSH0, otherwise deployment of your contracts will fail.
✅ Use:

<details><summary>1 Found Instances</summary>
```solidity
pragma solidity 0.8.19;
```

<details>
<summary>📍 1 Found Instance</summary>

- Found in src/GetGift.sol [Line: 2](src/GetGift.sol#L2)

```solidity
pragma solidity ^0.8.19;
```
* Located in `src/GetGift.sol` [Line 2](src/GetGift.sol#L2)

</details>

---

### L-2: 🧬 PUSH0 Opcode

## L-3: Large Numeric Literal

Large literal values multiples of 10000 can be replaced with scientific notation.Use `e` notation, for example: `1e18`, instead of its full numeric value.

<details><summary>1 Found Instances</summary>
The `PUSH0` opcode is introduced in Solidity 0.8.20. When deploying to non-mainnet chains that may not yet support the Shanghai EVM, confirm that `PUSH0` is supported or explicitly set an earlier EVM target.

<details>
<summary>📍 1 Found Instance</summary>

- Found in src/GetGift.sol [Line: 45](src/GetGift.sol#L45)

```solidity
uint32 public constant CALLBACK_GAS_LIMIT = 300_000;
```
* Located in `src/GetGift.sol` [Line 2](src/GetGift.sol#L2)

</details>

---

### L-3: 🔢 Large Numeric Literal

## L-4: Internal Function Used Only Once

Instead of separating the logic into a separate function, consider inlining the logic into the calling function. This can reduce the number of function calls and improve readability.

<details><summary>1 Found Instances</summary>
Prefer using scientific notation for large numbers.
Example:

```solidity
uint32 public constant CALLBACK_GAS_LIMIT = 300_000; // Prefer 3e5
```

- Found in src/GetGift.sol [Line: 135](src/GetGift.sol#L135)
<details>
<summary>📍 1 Found Instance</summary>

```solidity
function safeMint(address to, string memory uri) internal nonReentrant {
```
* Located in `src/GetGift.sol` [Line 45](src/GetGift.sol#L45)

</details>

---

### L-4: 🧩 Internal Function Used Only Once

## L-5: State Change Without Event
When an internal function is only called once, consider inlining to reduce indirection and improve readability.

There are state variable changes in this function but no event is emitted. Consider emitting an event to enable offchain indexers to track the changes.
<details>
<summary>📍 1 Found Instance</summary>

<details><summary>3 Found Instances</summary>
* Located in `src/GetGift.sol` [Line 135](src/GetGift.sol#L135)

</details>

- Found in src/GetGift.sol [Line: 142](src/GetGift.sol#L142)

```solidity
function addGift(string memory giftName, string memory _tokenUri) external onlyAllowList {
```
---

- Found in src/GetGift.sol [Line: 146](src/GetGift.sol#L146)
### L-5: 🏁 State Change Without Event

```solidity
function addToAllowList(address addrToAdd) external onlyAllowList {
```
It’s best practice to emit events for state changes to allow off-chain monitoring and transparency.

- Found in src/GetGift.sol [Line: 150](src/GetGift.sol#L150)
<details>
<summary>📍 3 Found Instances</summary>

```solidity
function removeFromAllowList() external onlyAllowList {
```
* Located in `src/GetGift.sol` [Line 142](src/GetGift.sol#L142)
* Located in `src/GetGift.sol` [Line 146](src/GetGift.sol#L146)
* Located in `src/GetGift.sol` [Line 150](src/GetGift.sol#L150)

</details>



24 changes: 0 additions & 24 deletions contract/.env

This file was deleted.

9 changes: 4 additions & 5 deletions contract/.gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -7,12 +7,11 @@ bin/


# Ignores development broadcast logs
!/broadcast
/broadcast/*/31337/
/broadcast/**/dry-run/
broadcast/


# Docs
docs/

mnemonic.txt
# Dotenv file
#.env
.env
Loading