Everyworld

QuantstampFiles named in the report

Quantstamp reviewed Everyworld on 5 May 2023: 3 findings, 0 critical; all marked fixed.

No open critical findings
Open the reportOpen Everyworld’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings3

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium000
Low003
LowIncompatibility Between Deployment Procedure and FxPortal Tunnel Implementation for ERC20 TransfersFixed

The new token mapper utilizes the [FxPortal](https://wiki.polygon.technology/docs/develop/l1-l2-communication/fx-portal/) for ERC20 transfers. The client plans to use the default FxPortal tunnel implementation as there is no custom FXPortal implementation present in the codebase. Since the default FXPortal implementation is being used, the token needs to be minted on the Root chain first. Upon the first usage of the deposit function, the child contract is [created](https://github.com/0xPolygon/fx-portal/blob/main/contracts/examples/erc20-transfer/FxERC20RootTunnel.sol#L79) on the [child chain](https://github.com/0xPolygon/fx-portal/blob/main/contracts/examples/erc20-transfer/FxERC20RootTunnel.sol#L71-L93). Therefore, all tokens need to be minted on the root chain before transfers can occur. However, the deployment described in the `README.md` is incompatible with the procedure required for the default FxPortal tunnel implementation for ERC20 transfers.

LowIncorrect Version of SolidityFixed

An [important bug](https://blog.soliditylang.org/2022/09/08/storage-write-removal-before-conditional-termination/) was identified in Solidity `0.8.16`. This is the version being used by the contract in scope.

LowRedundant Mint Address ValidationFixed

During deployment of the `Token` contract, the addresses within `_mintAddresses` are validated to ensure the receiving address of the mint is not the zero address. This is redundant since `ERC20._mint()` already performs the same validation.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (1)

  • Token.sol

Part of Everyworld’s security record

Everyworld
Audits1 audit by 1 firmLast audit May 2023, by Quantstamp.
Critical findingsNo open critical findingsIn 1 report.
Open Everyworld’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us