Quantstamp reviewed Everyworld on 5 May 2023: 3 findings, 0 critical; all marked fixed.
Report hosted on certificate.quantstamp.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 0 | 3 |
The new token mapper utilizes the [FxPortal](https://wiki.polygon.technology/docs/develop/l1-l2-communication/fx-portal/) for ERC20 transfers. The client plans to use the default FxPortal tunnel implementation as there is no custom FXPortal implementation present in the codebase. Since the default FXPortal implementation is being used, the token needs to be minted on the Root chain first. Upon the first usage of the deposit function, the child contract is [created](https://github.com/0xPolygon/fx-portal/blob/main/contracts/examples/erc20-transfer/FxERC20RootTunnel.sol#L79) on the [child chain](https://github.com/0xPolygon/fx-portal/blob/main/contracts/examples/erc20-transfer/FxERC20RootTunnel.sol#L71-L93). Therefore, all tokens need to be minted on the root chain before transfers can occur. However, the deployment described in the `README.md` is incompatible with the procedure required for the default FxPortal tunnel implementation for ERC20 transfers.
An [important bug](https://blog.soliditylang.org/2022/09/08/storage-write-removal-before-conditional-termination/) was identified in Solidity `0.8.16`. This is the version being used by the contract in scope.
During deployment of the `Token` contract, the addresses within `_mintAddresses` are validated to ensure the receiving address of the mint is not the zero address. This is redundant since `ERC20._mint()` already performs the same validation.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (1)
236 projects reviewed · 332 reports · latest Oct 2026
See Quantstamp’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us