GRQ V1

QuillAudits4 Apr 2025Files named in the report

Audit · firm’s term: audit report

QuillAudits reviewed GRQ V1 on 4 Apr 2025: 3 findings, 0 critical; all marked fixed.

No open critical findings

Open the report Open GRQ V1’s security record

Report hosted on quillaudits.com.

Trustblock does not review code.

Findings3

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	1
Medium	0	0	1
Low	0	0	1

HighThe contract increases the global rewardsPerSecond each time a pool starts, leading to more reward distributions.Fixed

The contract increases the global rewardsPerSecond each time a pool starts, leading to more reward distributions. Each new pool adds its allocation points to rewardsPerSecond, causing the total rewards to multiply with each pool addition. This could allow protocol to distribute significantly more rewards than intended.

MediumThe governanceRecoverUnsupported function lacks a reward token check.Fixed

There is no check for the input token as rewardToken in the recover function. While protected by timelock and multisig, this still remains an issue that could allow reward tokens to be recovered, potentially affecting user rewards.

LowNo check against zero address in setOperator functionFixed

No check against zero address in setOperator function , setting operator to zero address would permanently disable the access to call the operator functions .