/Reach Protocol

Quantstamp13 Nov 2023Files named in the report

Quantstamp reviewed Reach Protocol (/Reach Protocol) on 13 Nov 2023: 15 findings, 0 critical; 4 marked fixed, 7 acknowledged, 4 open.

No open critical findings

Open the report Open Reach Protocol’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings15

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	1	0
Medium	3	2	1
Low	1	4	3

MediumGreedy Contract / ERC20 Tokens Will Get Locked in the ContractFixed

The contract should be able to send either ETH or some ERC20 token when users claim rewards. The decision is based on the value of the state variable `tokenDistribution`. However, said variable remains uninitialized and there is also no setter function for it. This will lead the function `claimRewards()` to always try to send ETH even when it should send some `ERC20` tokens. Therefore, any ERC20 tokens sent to this contract will remain locked forever.

LowMissing Input ValidationFixed

The following parameters are not being validated: - `createDistribution._merkleRoot` should check that root is not empty - `setTokenAddress._token` should check that the contract at the address supports the ERC20 interface.

LowMissions Are Not Recorded On-ChainFixed

There is a `missions` mapping assumed to be used to keep track of all the missions created including the creator address and the mission’s amount. However, the variable is never updated nor used anywhere on the contract. This could impact how users expect the smart contract to behave.

LowOwnership Can Be RenouncedFixed

The function `renounceOwnership` in the `Ownable` contract is not overridden to prevent the contract from being left with no owner. If the contract reaches that state, major functions will stop working. For instance, it will not be possible to add/remove admins to the protocol.