flexUSD

Quantstamp9 Nov 2020Files named in the report

Audit

Quantstamp reviewed flexUSD on 9 Nov 2020: 11 findings, 0 critical; 4 marked fixed, 5 acknowledged, 2 open.

No open critical findings

Open the report Open flexUSD’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings11

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	0	2	1
Low	2	3	3

MediumLack of TestsFixed

The current implementation lacks test scripts to verify whether the implementation works as expected. Writing test code is the minimal QA effort expected from any project willing to identify errors and/or flaws in the implementation.

LowMissing Input ValidationFixed

The input parameter `account ` of `TransferOwnerShip()` is missing validation. Providing incorrect values may result in a later discovery that the smart contract is not working as intended (e.g., Unupdatable multiplier).

LowUnknown Contract Artifact in Deployment CodeFixed

In `2_deploy_smartcontract.js`, an unknown artifact called `CURRYSWAP` is referred to.

LowUnlocked PragmaFixed

Every Solidity file specifies in the header a version number of the format `pragma solidity (^)0.6.*`. The caret (`^`) before the version number implies an unlocked pragma, meaning that the compiler will use the specified version _and above_, hence the term "unlocked".