Sonic Gateway

Quantstamp17 Oct 2024Files named in the report

Audit

Quantstamp reviewed Sonic Gateway on 17 Oct 2024: 7 findings, 0 critical; 5 marked fixed, 2 acknowledged.

No open critical findings

Open the report Open Sonic Gateway’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings9

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	0	0
High	0	1
Medium	1	2
Low	1	2

Marked Informational by the firm. Not counted as findings.

InformationalMultiplication After DivisionFixed

The `verifyUpdate()` function, found in both `SFCUpdateVerifier` and `ValidatorsRegistry`, contains the following line of code: `require(weight > totalWeight() / 3 * 2, "Insufficient signatures weight");` As Solidity only supports integer division, the result of `totalWeight / 3` will be floored prior to being multiplied by 2. There can be slight inaccuracies in this calculation is a 2 / 3 validator weight is trying to be achieved.

InformationalUsage of `selfdestruct` Can Deny Servicing of `UpdateManager.payFastLane()`Fixed

The following require statement is included to ensure that once a fast lane reward is deposited, there isn't another one deposited until the first is consumed. `require(address(this).balance == msg.value, "Fast lane busy");` This is found in `payFastLane()` a `payable` function, which is intended to be the only entry point for ETH in the contract. However, if a savvy user wanted to disrupt calls to this function, they can do so by forcing ETH into the balance of this contract. Although, there is no real incentive for anyone to do this, as they will be wasting their own money, and ultimately contributing to the fast lane reward, for free. Further, after the first call to `update()` this deposit would be consumed.