TenX Titan

Quantstamp11 Nov 2020Files named in the report

Audit

Quantstamp reviewed TenX (TenX Titan) on 11 Nov 2020: 8 findings, 0 critical; 4 marked fixed, 4 acknowledged.

No open critical findings

Open the report Open TenX’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings8

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	0	0
High	0	0
Medium	0	0
Low	4	4

LowLack of input validationFixed

Functions do not check if arguments of type address are non-zero in the following: * `AddressProvider.sol`, functions: `setAccessController()`, `setConfigProvider()`, `setVaultsCore()`, `setStableX()`, `setRatesManager()`, `setPriceFeed()`, `setVaultsDataProvider()`, `setFeeDistributor()`. * `ConfigProvider.setCollateralConfig()`. * `LiquidiationManager.constructor()`. * `PriceFeed.setAssetOracle()`. * `PriceFeedEUR.sol`, functions: `setAssetOracle()` and `setEurOracle()`. * `RatesManager.constructor()`. * `VaultsCore.sol`, functions: `constructor()`, `upgrade()`, `initializeRates()`, `refreshCollateral()`, and `deposit()`. * `VaultsDataProvider.sol`, functions: `constructor()` and `createVault()`. * `FeeDistributor.constructor()`. * `EURX.constructor()`. * `USDX.constructor()`.

LowPotential division by zeroFixed

There is a chance that `ConfigProvider.minCollateralRatio` is set to 0. In case that happens, the division in `LiquidationManager.sol#63` would fail due to division by 0.

LowUnlocked PragmaFixed

Every Solidity file specifies in the header a version number of the format `pragma solidity (^)0.6.*`. The caret (`^`) before the version number implies an unlocked pragma, meaning that the compiler will use the specified version _and above_, hence the term "unlocked".

LowVarious calls to ERC20 functions are not in `require` statementsFixed

Calls to ERC20 functions on external assets are not wrapped in `require()` statements.