TenX Titan

Quantstamp11 Nov 2020Files named in the report

Audit

Quantstamp reviewed TenX (TenX Titan) on 11 Nov 2020: 8 findings, 0 critical; 4 marked fixed, 4 acknowledged.

No open critical findings

Open the report Open TenX’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings8

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	0	0
High	0	0
Medium	0	0
Low	4	4

LowDependency on external contractsAcknowledged

The contracts `PriceFeed`, `PriceFeedEUR`, and `VaultsCore` depend on external contracts. Furthermore, `PriceFeed`, `PriceFeedEUR` depend on `decimals()` to determine price accuracy. It is important to note that according to [EIP-20](https://github.com/ethereum/EIPs/blob/master/EIPS/eip-20.md), this method/field is optional. `VaultsCore` depends on the `transfer()` functionality of external tokens.

LowLiquidation may be impossible is there is not funds in the insurance fundAcknowledged

Due to the condition in L293 liquidation may be impossible if there is not enough funds in the insurance fund in a corner case when value of collateral drops below debt value.

LowPotential sensitivity to price movementsAcknowledged

As with many DeFi project which depend on external oracles, if an attacker can manipulate the market (and, consequently, the price as reported by oracles), they may be able to liquidate other participants' vaults when the collateral value drops below a liquidation threshold.

LowPrivileged Roles and OwnershipAcknowledged

Smart contracts will often have `owner` variables to designate the person with special privileges to make modifications to the smart contract. Specifically, the contract `EURX` and `USDX` have a special minter role. The contracts `FeeDistributor`, `AddressProvider`, `ConfigProvider`, `PriceFeed`, `PriceFeedEUR` feature a manager role. Notably, in `ConfigProvider.sol` manager can set arbitrary debt limit, collateral ratio, borrow rate, etc.