Audit report published Mar 2025. Ethereum · Solidity.
| Severity | Count |
|---|---|
| Medium | 3 |
| Low | 3 |
| Informational | 5 |
| Total | 11 |
Safe Edges reviewed Clique's token distribution and vesting contracts (b3-contracts) on Ethereum between 17 and 20 March 2025. Eleven issues were identified: three Medium, three Low and five Informational. The Clique team fixed five and acknowledged six, including two of the three Medium issues.
M-01 Incorrect totalPieces calculation in CliqueLock:calculateClaimableAmount can lead to uneven vesting amount distribution — ResolvedM-02 Anyone can initiate claims for any stream using just the streamId in CliqueLock:claim — AcknowledgedM-03 CliqueDistributorManager:createDistributor should explicitly check for signature non-malleability — AcknowledgedL-01 Excessive Ether sent to Distributor:claim is not refunded — AcknowledgedL-02 Missing fee validation checks in Distributor:setFee — ResolvedL-03 CliqueLock:_createStream lacks multiple validations before creating a stream — ResolvedI-01 Duplicate import of ECDSA in CliqueDistributorManager.sol — ResolvedI-02 Missing check for signature usage in CliqueDistributorManager:createDistributor — AcknowledgedI-03 Use SafeERC20 for secure token transfers — AcknowledgedI-04 Missing address(0) checks for critical state variables — AcknowledgedI-05 Remove unused custom errors to optimize gas usage — ResolvedSend the repository and a commit hash through the contact form, message @bugtester25 on Telegram, or book a 30-minute scoping call. 200+ protocols audited · $4B+ secured · 0 hacks post-audit. Prefer email? info@safeedges.in.