Sonic Gateway

Quantstamp17 Oct 2024Files named in the report

Audit

Quantstamp reviewed Sonic Gateway on 17 Oct 2024: 7 findings, 0 critical; 5 marked fixed, 2 acknowledged.

No open critical findings

Open the report Open Sonic Gateway’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings9

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	0	0
High	0	1
Medium	1	2
Low	1	2

MediumFront-running Can Lead to Stolen Validator RewardsAcknowledged

The `update()` function is callable by anyone, allowing an attacker that monitors the transaction pool to submit a transaction calling the function with correct parameters and a higher gas price. As the function transfers the contract balance to the function caller, the attacker may be able to claim a reward intended for validators.

LowMissing Support for Automatic Rebasing TokensAcknowledged

When depositing tokens on Ethereum to bridge to Sonic Network the `TokenDeposit` contract accounts for any fee-on-transfer tokens by calculating the true balance of tokens received by the contract before beginning the bridging process for a user. However, there is inadequate support for automatic rebasing tokens, such as `stETH`. Users bridging automatically rebasing tokens will eventually have their rebasing rewards stuck in the `TokenDeposit` contract.