/Reach Protocol

Quantstamp13 Nov 2023Files named in the report

Quantstamp reviewed Reach Protocol (/Reach Protocol) on 13 Nov 2023: 15 findings, 0 critical; 4 marked fixed, 7 acknowledged, 4 open.

No open critical findings

Open the report Open Reach Protocol’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings15

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	1	0
Medium	3	2	1
Low	1	4	3

Medium`createDistribution()` Does Not Support `_paymentType`Open

This issue is newly added during the fix-review. In the provided commit hash `8afbbf4` for the fix-review, the functions `createMission()` and `claimRewards()` were updated to accept the parameter `_paymentType`. However, `createDistribution()` was not and the check `require(address(this).balance >= _amount, "Insufficient balance.");` will reject reward tokens other than Ether.

MediumCentralized Power / A Malicious Admin Can Deny ClaimingOpen

The protocol allows for an unlimited number of admins. An admin has the power to invoke the function `createDistribution`, which changes the current `merkleRoot` and the `currentVersion` variable. This can be used to prevent users from claiming in a given round.

MediumCentralized Power / THe Owner's Power Over the AdminsOpen

The owner of the contract can add/remove any number of admins. This means all the protection from the admins can be voided by a malicious owner. Once the owner itself gets hacked, everything will go down without any measure to stop it.

LowNo Function to Withdraw FundsOpen

The docs state that there should be a `withdraw` function that allows the owner to withdraw excessive funds, however there is no function that does that.