Velar Labs

QuillAudits1 address on Ethereum

Audit · firm’s term: audit report

QuillAudits reviewed Velar (Velar Labs) on 18 Mar 2024: 4 findings, 0 critical; none marked fixed.

No open critical findings
Open the reportOpen Velar’s security record

Report hosted on quillaudits.com.

Trustblock does not review code.

Findings4

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium000
Low400
Low6 decimal places can cause problem in future.Open

According to the protocol’s whitepaper, the Velar token is intended to be used in the entire velar ecosystem, including Governance, Staking, etc.In that case, integrating the Velar token might create much more redundant complexity in calculations in future smart contract developments. It will become more prone to rounding issues if not handled properly. Here 1 token would be 1*(10**6) = 1000000000 Wei. It may happen that any other smart contract uses/accepts this token for some reason. That smart contract calculates the token amount sent by the user assuming its 18 decimal token, which can result in unwanted outcomes. Eg:  care needs to be taken in this type of scenario. User sends 1 token (“1*(10**6)” in this case) to a smart contract. The smart contract which accepts this token checks the token amount sent by User which was 1*(10**8) = 100000000 While calculating amount sent by the User, smart contract uses 18 decimals and expects 1 token sent to be 1*(10**18) = 1000000000000000000 In this case this condition will fail since token amount sent by User is 1000000 i.e 1*(10**6) and not 1*(10**18)

LowAvoid using floating pragmaOpen

Floating pragma should only be used when a contract is intended for consumption by other developers.Locking the pragma helps ensure that contracts are not accidentally deployed using, for example, the latest compiler, which may have higher risks of undiscovered bugs.

LowConsider defining a constantOpen

The contract uses literals with many digits, potentially leading to human error or misleading, particularly when the number of zeros is large. However, in the provided smart contract code, the _mint function is called with a clear multiplication of two numbers, '1000000000' and '10**decimals()'.  Since the decimals function overrides the standard 18 decimals with 6, the actual number minted is '1000000000 * 10**6', which is intentional and correct for the token's intended design. There is no inherent vulnerability in having a large number of tokens; it is a design decision that affects the granularity and distribution of the token.

LowRemove Unused InterfacesOpen

The contract inherited a couple of Interfaces intended to aid achieve the safety creation of ERC20 token. However, there are some Interfaces that were left unused in the contract.

Contracts in scope1

AddressChainSource code
0x033bbde722ea3cdcec73cffea6581df9f9c257deChain: EthereumSource code: Verified source

Part of Velar’s security record

Velar
Audits2 audits by 1 firmLast audit Mar 2024, by QuillAudits.
Critical findingsNo open critical findingsAcross 2 reports.
Open Velar’s security record

Security firm

QuillAudits

350 projects reviewed · 459 reports · latest Apr 2025

See QuillAudits’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us