# Functions can be marked external when only called from other contracts Low/Info · Three Sigma · Zero-knowledge compliance · 10th July, 2024 Finding 3S-Keyring-N05 of the Keyring Credentials security review. - Protocol: https://www.keyring.network/ - Report: /reports/keyring-ii - Source: https://cdn.sanity.io/files/qoqld077/production/75b68b74f4b0dc6fbcd94892d934547d8259b57a.pdf --- ### Description Functions that are never called internally should be marked external. ### Recommendation ```solidity Set KeyringCoreV2Base::createCredential(), KeyringCoreV2Base::blacklistEntity(), KeyringCoreV2Base::unblacklistEntity(), ``` KeyringCoreV2Base::collectFees() to external. ### Status Addressed in [#ffe8b11](https://github.com/Keyring-Network/core-v2/commit/ffe8b11b3c8b1eaadb1713eb19e80872a9d1c630). --- Related findings: - [All functions could have a `started` modifier as they should not be called before the start time](https://0xsimao.com/findings/codeup-started-modifier-called-time): CODEUP