Quantstamp reviewed Solv Protocol (Solv Protocol - SolvBTC) on 15 Aug 2024: 7 findings, 0 critical; 3 marked fixed, 3 acknowledged, 1 open.
Report hosted on certificate.quantstamp.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 1 | 0 | 0 |
| Low | 0 | 3 | 3 |
The `admin` of the `SftWrappedTokenFactory` contract can upgrade the implementation contract for a given `productType_` by calling `setImplementation()` followed by a call to `upgradeBeacon()`. However, if `upgradeBeacon()` is not called, the `productTypes` mapping in the `SftWrappedTokenFactory` contract will have a mismatched `implementation` address than what is set in the beacon contract.
When the contract admin attempts to remove an SFT slot from the `SolvBTCMultiAssetPool`, the pool contract must have a zero balance of the given SFT slot before removal. Therefore, if even one user fails to withdraw their SFT, the admin will be unable to remove the slot, which allows other users to deposit the SFT slot continually into the contract.
When executing `stake()` in the `SftWrapRouter` contract, the SFT wrapped token registered for the SFT slot in the `SftWrappedTokenFactory` contract is obtained via a call to `SftWrappedTokenFactory.sftWrappedTokens()`. If the returned `sftWrappedToken` address is the zero address, execution will fail, and staking cannot occur for the given SFT slot. This check prevents users from staking SFT slots that are only registered in the `SolvBTVMultiAssetPool` and not registered in `SftWrappedTokenFactory`. Further, the function `_stakeSft()`, which is executed after the `SftWrapRouter` contract receives the SFT, only deposits into the legacy `SftWrappedToken` contract if the `SolvBTCMultiAssetPool` contract disallows the SFT slot. Therefore, the zero address check in `stake()` will prevent non-legacy-supported SFT slots from being staked.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (5)
236 projects reviewed · 332 reports · latest Oct 2026
See Quantstamp’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us