Acid - DigixDAO Dissolution Contract

QuantstampFiles named in the report

Quantstamp reviewed Acid (Acid - DigixDAO Dissolution Contract) on 27 Jan 2020: 7 findings, 0 critical; all marked fixed.

No open critical findings
Open the reportOpen Acid’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings7

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High001
Medium003
Low003
HighUnchecked Return ValueFixed

Most functions will return a `true` or `false` value upon success. Some functions, like `send()`, are more crucial to check than others. It's important to ensure that every necessary function is checked. Line 53 of `Acid.sol` transfers Ether using `address.call.value()`. If the transfer fails, this method does not revert the transaction. Instead, it returns `false`. The check for the return value is not present in the code.

MediumGas Usage / `for` Loop ConcernsFixed

Gas usage is a main concern for smart contract developers and users, since high gas costs may prevent users from wanting to use the smart contract. Even worse, some gas usage issues may prevent the contract from providing services entirely. For example, if a `for` loop requires too much gas to exit, then it may prevent the contract from functioning correctly entirely. It is best to break such loops into individual functions as possible.

MediumInteger Overflow / UnderflowFixed

Integer overflow/underflow occur when an integer hits its bit-size limit. Every integer has a set range; when that range is passed, the value loops back around. A clock is a good analogy: at 11:59, the minute hand goes to 0, not 60, because 59 is the largest possible minute. Integer overflow and underflow may cause many unexpected kinds of behavior and was the core reason for the `batchOverflow` attack. Here's an example with `uint8` variables, meaning unsigned integers with a range of `0..255`. ``` function under_over_flow() public { uint8 num_players = 0; num_players = num_players - 1; // 0 - 1 now equals 255! if (num_players == 255) { emit LogUnderflow(); // underflow occurred } uint8 jackpot = 255; jackpot = jackpot + 1; // 255 + 1 now equals 0! if (jackpot == 0) { emit LogOverflow(); // overflow occurred } } ```

MediumRepeatedly InitializableFixed

The contract is repeatedly initializable.

LowRace Conditions / Front-RunningFixed

A block is an ordered collection of transactions from all around the network. It's possible for the ordering of these transactions to manipulate the end result of a block. A miner attacker can take advantage of this by generating and moving transactions in a way that benefits themselves.

LowUnchecked ParameterFixed

The address as input for the `init` function is never checked to be non-zero in `Acid.sol`.

LowUnlocked PragmaFixed

Every Solidity file specifies in the header a version number of the format `pragma solidity (^)0.4.*`. The caret (`^`) before the version number implies an unlocked pragma, meaning that the compiler will use the specified version _and above_, hence the term "unlocked." For consistency and to prevent unexpected behavior in the future, it is recommended to remove the caret to lock the file onto a specific Solidity version.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (2)

  • contracts/Migrations.sol
  • contracts/Acid.sol

Part of Acid’s security record

Acid
Audits2 audits by 2 firmsLast audit Apr 2023, by HashEx.
Critical findingsNo open critical findingsAcross 2 reports.
Open Acid’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us