Mavia Token

QuantstampFiles named in the report

Quantstamp reviewed Mavia Token on 6 Nov 2023: 9 findings, 0 critical; 4 marked fixed, 5 acknowledged.

No open critical findings
Open the reportOpen Mavia Token’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings9

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High001
Medium030
Low023
HighRegistered Gateways Can Transfer Mavia Tokens without ApprovalFixed

Any address registered as a *gateway* can transfer Mavia tokens from **any** address, even when a Mavia token holder has not approved the gateway address. Additionally, due to the `fBurn()` function, a gateway address can burn tokens from any other address by transferring the tokens to themself and burning the tokens. According to the client, gateway addresses are used for their "pool/dapp/bridge". However, this implies the following trust assumptions for the user: 1. The user has to trust the admin only to set such applications as gateway addresses and no other addresses. 1. The user has to trust that these applications are secure and cannot misuse their privileged access. 1. The user has to trust that the admin acts honestly and the keys are not compromised.

LowInconsistent Use of `_msgSender()` and `msg.sender`Fixed

Throughout the contact, the message sender is obtained via `_msgSender()` and `msg.sender`. For consistency, get the caller's address using only `_msgSender()`.

LowIndex Event Parameters for Improved Application MonitoringFixed

Application monitoring can be improved by [indexing](https://docs.soliditylang.org/en/v0.8.4/cheatsheet.html#modifiers) specific parameters emitted in an event. By indexing event parameters, off-chain systems can more easily filter contract logs by the indexed data. The following event parameters could benefit from indexing: 1. `_pAddr` in the event `ESetBlacklist`. 2. `_pAddr` in the event `ESetWhitelist`. 3. `_pAddr` in the event `ESetGateway`. 4. `_pToken` in the event `EEmerERC20Tokens`.

LowTruffle Suite Has Been SunsetFixed

Truffle and Ganache have recently been [sunset](https://consensys.io/blog/consensys-announces-the-sunset-of-truffle-and-ganache-and-new-hardhat?utm_source=github&utm_medium=referral&utm_campaign=2023_Sep_truffle-sunset-2023_announcement_). Consider using tooling that will be continuously supported through the lifetime of Mavia token.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (1)

  • src/active/MaviaToken.sol

Part of Mavia Token’s security record

Mavia Token
Audits1 audit by 1 firmLast audit Nov 2023, by Quantstamp.
Critical findingsNo open critical findingsIn 1 report.
Open Mavia Token’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us