Audit · firm’s term: audit report
QuillAudits reviewed Beam (Beam V2) on 6 Jan 2025: 5 findings, 0 critical; all marked fixed.
Report hosted on quillaudits.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 2 |
| Low | 0 | 0 | 3 |
There is an edge case where rounding issue can create dust amount which will accumulate overtimewhenever swap happens. However there is no way to pull those funds out.
The current implementation of _executeSwap might not be able to handle Fee on Transfer Tokens.This is because the router will receive less amount than expected and will then proceed to execute as if the input amount is same.
The current code lack input sanitization of the parameters that are passed. This leads to break a wholelot of invariants that a router should hold creating in unintended consequences. Here is a list of core invariants that should be checked. A route must consist at least of two tokens. RouterLogic must never consume more input tokens than the provided. Only the Router can invoke swapExactInput/swapExactInputSingle. Amounts must never be larger than uint128.max. During swapExactInput, all input amounts must be consumed without any leftovers. Token addresses must be unique.
Currently swapExactInput , swapExactInputSingle lacks non-reentrant modifer. This means that thereis a scenario under which one can reenter into these function before the previous execution is fnished. While an actual reentrant poc has not be crafted, it has been observed that most of exploits happen due to arbitrary user input. Therefore it is crucial to limit the user fexibility.
Contract contains unused elements that do not serve any functional purpose, increasing the codebase size unnecessarily:event: CustomApproval, errors: WrongGasContract, NotEnoughToPayGasFee, ChainNotEnabled and INIT_CODE_HASH: is declared but not utilized in any function
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (7)
350 projects reviewed · 459 reports · latest Apr 2025
See QuillAudits’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us