Beam V2

QuillAuditsFiles named in the report

Audit · firm’s term: audit report

QuillAudits reviewed Beam (Beam V2) on 6 Jan 2025: 5 findings, 0 critical; all marked fixed.

No open critical findings
Open the reportOpen Beam’s security record

Report hosted on quillaudits.com.

Trustblock does not review code.

Findings5

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium002
Low003
MediumImplement a function to sweep dust accumulationFixed

There is an edge case where rounding issue can create dust amount which will accumulate overtimewhenever swap happens. However there is no way to pull those funds out.

MediumRouter is not able to handle Fee on Transfer TokensFixed

The current implementation of _executeSwap might not be able to handle Fee on Transfer Tokens.This is because the router will receive less amount than expected and will then proceed to execute as if the input amount is same.

LowConsider sanitizing user inputsFixed

The current code lack input sanitization of the parameters that are passed. This leads to break a wholelot of invariants that a router should hold creating in unintended consequences. Here is a list of core invariants that should be checked. A route must consist at least of two tokens. RouterLogic must never consume more input tokens than the provided. Only the Router can invoke swapExactInput/swapExactInputSingle. Amounts must never be larger than uint128.max. During swapExactInput, all input amounts must be consumed without any leftovers. Token addresses must be unique.

LowLack of reentrancy guard may result in unintended statesFixed

Currently swapExactInput , swapExactInputSingle lacks non-reentrant modifer. This means that thereis a scenario under which one can reenter into these function before the previous execution is fnished. While an actual reentrant poc has not be crafted, it has been observed that most of exploits happen due to arbitrary user input. Therefore it is crucial to limit the user fexibility.

LowUnused Event, Error and INIT_CODE_HASHFixed

Contract contains unused elements that do not serve any functional purpose, increasing the codebase size unnecessarily:event: CustomApproval, errors: WrongGasContract, NotEnoughToPayGasFee, ChainNotEnabled and INIT_CODE_HASH: is declared but not utilized in any function

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (7)

  • UniswapV2Library.sol
  • BitcoinRouter.sol
  • SafeMath.sol
  • MessageParserLib.sol
  • BitcoinMessageParserLib.sol
  • MultichainRouter.sol
  • AlgebraSwapHelperLib.sol

Part of Beam’s security record

Beam
Audits3 audits by 2 firmsLast audit Jan 2025, by QuillAudits.
Critical findingsNo open critical findingsAcross 3 reports.
Open Beam’s security record

Security firm

QuillAudits

350 projects reviewed · 459 reports · latest Apr 2025

See QuillAudits’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us