Quranium

QuillAudits15 Nov 20241 address on Arbitrum

Audit · firm’s term: audit report

QuillAudits reviewed Quranium on 15 Nov 2024: 19 findings, 0 critical; 14 marked fixed, 5 open.

No open critical findings

Open the report Open Quranium’s security record

Report hosted on quillaudits.com.

Trustblock does not review code.

Findings19

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	0	6
Medium	2	6
Low	3	2

MediumReferral rewards cannot be withdrawnOpen

The contract accrues referral rewards for those who register, values are stored on the contract, however there is no function that enables rewards of the actual accrued rewards.

MediumStale Price from chainlinkOpen

There are multiple problems when validating the price feed data that is used in `getTokenPrice()`. - Price staleness not checked - Sequencer downtime not checked By not checking the price staleness or sequencer uptime, token amounts calculated in `getTokenPrice()` can be wrong in severe cases, allowing users to purchase tokens at discounted rates.

LowDead CodeOpen

The event and variable below are unused.L34: mapping(address => mapping(address => uint256)) public referralRewards; L56: event BaseImageURISet(string newBaseImageURI); L214: function getReferralRewards(...) L408: pricePerNodeInEth = tierPrices[currentTier];

LowTier Prices not fully changedOpen

Tier prices were changed from Tier 1 to Tier 12 by a factor of 1000, However it wasn't updated from 13-77.

LowUse SafeTransferOpen

Although tokens being used in this contract are known, it is best practice to use SafeERC20 to handle safe transfers of fungible tokens, this would prevent unforeseen scenarios