PoSciDonDAO

QuillAudits12 Feb 2025Files named in the report

QuillAudits reviewed PoSciDonDAO on 12 Feb 2025: 5 findings, 0 critical; all marked fixed.

No open critical findings

Open the report Open PoSciDonDAO’s security record

Report hosted on quillaudits.com.

Trustblock does not review code.

Findings5

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	0	0	1
Low	0	0	4

MediumOwnership Renouncement Risk in AccessControl ImplementationFixed

The contract inherits from OpenZeppelin's AccessControl and uses DEFAULT_ADMIN_ROLE. If theadmin renounces their role using the inherited renounceRole() function, it would set the owner address to zero, potentially leaving the contract without administrative control.

LowAdmin Role Changes Should Be Two StepFixed

The setAdmin() function transfers administrative privileges in a single step. If the admin address isincorrectly set, it could result in a loss of administrative control over the contract.

LowIncorrect Comment for voteLockEnd ParameterFixed

In the voted() and proposed() function, the comments for the voteLockEnd and proposeLockEnd parameter incorrectly states it's a block number when it's actually a timestamp.

LowMissing Same-Address Check in setGovOps()Fixed

The setGovOps() function lacks a check for setting the same address that is currently set, whilesetGovRes() includes this check. This inconsistency could lead to unnecessary state updates

LowMissing Total Supply Validation in Lock FunctionFixed

The lock() function does not validate that the newly locked amount plus already locked tokens (_totLocked) doesn't exceed the TOTAL_SUPPLY_SCI. This could allow locking more tokens than should exist