Metis

QuillAudits28 Aug 2023Files named in the report

Audit · firm’s term: audit report

QuillAudits reviewed Metis on 28 Aug 2023: 5 findings, 0 critical; all marked fixed.

No open critical findings

Open the report Open Metis’s security record

Report hosted on quillaudits.com.

Trustblock does not review code.

Findings5

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	0	0	0
Low	0	0	5

LowIncorrect Input Value SanitizationFixed

At the constructor level where some variables are to be set for the contract, there was a check to ensure that the passed parameters for the minPrice and maxPrice stays between a minPrice lower than maxPrice and a maxPrice below and/or equal to the PRICE_PRECISION. This check will always pass because it checks the state variable instead with the input values passed into the constructor function.

LowOwnership Transfer should be a Two-way ProcessFixed

the contract owner plays a critical role to every of the activity happening on the vault; from regulating the claiming of airdrops with the pause and unpause attribute, to the claiming of rMetis remnant in contract, to redeeming Metis on the price ratio of 1:1, to also redeeming slashed fees. It is important to state the safety of ownership transfer to ensure that a mistaken transfer does not cost losing ownership properties to an unintended address or the null address. The transferOwnership in Openzeppelin Ownable contract automatically sets the passed address as the new owner.

LowPrevent Deposit Function Call when Msg.value is ZeroFixed

The deposit function can only be called by the owner of the Vesting Vault contract so that the redemption tokens gets minted the exact amount of rMetis token. However, when there is no msg.value sent with the deposit function, no rMetis token is minted but the function is successful. This will cause a waste of gas when called without a native token.

LowUnlocked pragma ( pragma solidity ^0.8.0 )Fixed

Contracts should be deployed with the same compiler version and flags that they have been tested with thoroughly. Locking the pragma helps to ensure that contracts do not accidentally get deployed using, for example, an outdated compiler version that might introduce bugs that affect the contract system negatively.

LowVariables without a Setter Function can be set as ImmutableFixed

There are some variables in the contract that only get set at the constructor level but have no other setter functions to change them again in the contract. Making these variables immutable will prevent adding them to the storage slot and instead make them inline with the contract bytecode that gets accessed without overhead gas when needed to perform a functionality. The variables are as follows:• merkleRoot • claimDeadline • startDate • endDate • minPrice • maxPrice