Audit · firm’s term: audit report
QuillAudits reviewed Velar (Velar Labs) on 18 Mar 2024: 4 findings, 0 critical; none marked fixed.
Report hosted on quillaudits.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 4 | 0 | 0 |
According to the protocol’s whitepaper, the Velar token is intended to be used in the entire velar ecosystem, including Governance, Staking, etc.In that case, integrating the Velar token might create much more redundant complexity in calculations in future smart contract developments. It will become more prone to rounding issues if not handled properly. Here 1 token would be 1*(10**6) = 1000000000 Wei. It may happen that any other smart contract uses/accepts this token for some reason. That smart contract calculates the token amount sent by the user assuming its 18 decimal token, which can result in unwanted outcomes. Eg: care needs to be taken in this type of scenario. User sends 1 token (“1*(10**6)” in this case) to a smart contract. The smart contract which accepts this token checks the token amount sent by User which was 1*(10**8) = 100000000 While calculating amount sent by the User, smart contract uses 18 decimals and expects 1 token sent to be 1*(10**18) = 1000000000000000000 In this case this condition will fail since token amount sent by User is 1000000 i.e 1*(10**6) and not 1*(10**18)
Floating pragma should only be used when a contract is intended for consumption by other developers.Locking the pragma helps ensure that contracts are not accidentally deployed using, for example, the latest compiler, which may have higher risks of undiscovered bugs.
The contract uses literals with many digits, potentially leading to human error or misleading, particularly when the number of zeros is large. However, in the provided smart contract code, the _mint function is called with a clear multiplication of two numbers, '1000000000' and '10**decimals()'. Since the decimals function overrides the standard 18 decimals with 6, the actual number minted is '1000000000 * 10**6', which is intentional and correct for the token's intended design. There is no inherent vulnerability in having a large number of tokens; it is a design decision that affects the granularity and distribution of the token.
The contract inherited a couple of Interfaces intended to aid achieve the safety creation of ERC20 token. However, there are some Interfaces that were left unused in the contract.
| Address | Chain | Source code |
|---|---|---|
| 0x033b…57de0x033bbde722ea3cdcec73cffea6581df9f9c257de | Chain: Ethereum | Source code: Verified source |
350 projects reviewed · 459 reports · latest Apr 2025
See QuillAudits’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us