Quantstamp reviewed Mavia Token on 6 Nov 2023: 9 findings, 0 critical; 4 marked fixed, 5 acknowledged.
Report hosted on certificate.quantstamp.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 3 | 0 |
| Low | 0 | 2 | 3 |
Any address registered as a *gateway* can transfer Mavia tokens from **any** address, even when a Mavia token holder has not approved the gateway address. Additionally, due to the `fBurn()` function, a gateway address can burn tokens from any other address by transferring the tokens to themself and burning the tokens. According to the client, gateway addresses are used for their "pool/dapp/bridge". However, this implies the following trust assumptions for the user: 1. The user has to trust the admin only to set such applications as gateway addresses and no other addresses. 1. The user has to trust that these applications are secure and cannot misuse their privileged access. 1. The user has to trust that the admin acts honestly and the keys are not compromised.
Throughout the contact, the message sender is obtained via `_msgSender()` and `msg.sender`. For consistency, get the caller's address using only `_msgSender()`.
Application monitoring can be improved by [indexing](https://docs.soliditylang.org/en/v0.8.4/cheatsheet.html#modifiers) specific parameters emitted in an event. By indexing event parameters, off-chain systems can more easily filter contract logs by the indexed data. The following event parameters could benefit from indexing: 1. `_pAddr` in the event `ESetBlacklist`. 2. `_pAddr` in the event `ESetWhitelist`. 3. `_pAddr` in the event `ESetGateway`. 4. `_pToken` in the event `EEmerERC20Tokens`.
Truffle and Ganache have recently been [sunset](https://consensys.io/blog/consensys-announces-the-sunset-of-truffle-and-ganache-and-new-hardhat?utm_source=github&utm_medium=referral&utm_campaign=2023_Sep_truffle-sunset-2023_announcement_). Consider using tooling that will be continuously supported through the lifetime of Mavia token.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (1)
236 projects reviewed · 332 reports · latest Oct 2026
See Quantstamp’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us