Aavegotchi GHST Staking

Quantstamp15 Oct 2020Files named in the report

Quantstamp reviewed Aavegotchi (Aavegotchi GHST Staking) on 15 Oct 2020: 7 findings, 0 critical; 3 marked fixed, 3 acknowledged, 1 open.

No open critical findings

Open the report Open Aavegotchi’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings7

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	1	0	0
Medium	0	0	0
Low	0	3	3

LowClone-and-OwnAcknowledged

The clone-and-own approach involves copying and adjusting open source code at one's own discretion. From the development perspective, it is initially beneficial as it reduces the amount of effort. However, from the security perspective, it involves some risks as the code may not follow the best practices, may contain a security vulnerability, or may include intentionally or unintentionally modified upstream libraries.

LowDiamond facet upgradeAcknowledged

If during an upgrade `diamondCut()` calls are executed in multiple Ethereum transactions, users may be exposed to contracts that are upgraded only partially, i.e., some of the functions are upgraded while others are not. This may result in unexpected inconsistencies.

LowStorage Data PackingAcknowledged

All data packing for `LibDiamond.DiamondStorage` is done manually whereas structures could be used instead. The compiler will tightly pack any ordered state variables by groups of 32 bytes and use only one storage slot (also applicable for struct members). Please note that all the necessary operations for reading and writing variables will be created and optimized automatically by the compiler.