TokenSoft Token

QuantstampFiles named in the report

Quantstamp reviewed TokenSoft Token on 16 Jun 2020: 5 findings, 0 critical; 2 marked fixed, 3 acknowledged.

No open critical findings
Open the reportOpen TokenSoft Token’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings5

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium010
Low022
MediumPrivileged Roles and OwnershipAcknowledged

Smart contracts will often have `Owner` variables to designate the person with special privileges to make modifications to the smart contract. Currently, the `Owner` role can add/remove other roles as well as other owners. Moreover, the `Revoker` role can transfer funds between users readily, which may be a dangerous privilege. If these privileged members lose their private keys, regular users may suffer from lost funds and unexpected behaviour.

LowAllowance Double-Spend ExploitAcknowledged

As it presently is constructed, the contract is vulnerable to the [allowance double-spend exploit](https://github.com/OpenZeppelin/openzeppelin-solidity/blob/b4f87bb8fc25fb07f73099701e39e167a3d36465/contracts/token/ERC20/ERC20.sol#L71-L78), as with other ERC20 tokens.

LowNo Proxy Verification for a Contract Account AddressAcknowledged

In the constructor of `Proxy.sol`there is no verification as to whether or not `contractLogic` contains code. This creates a risk for human errors were during the `Proxy` contract deployment where an arbitrary externally owned account may be stored instead of a contract account inside the proxy. Furthermore, executing transactions on a non-contract address will not throw any errors, which can be problematic.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (20)

  • contracts/ERC1404.sol
  • contracts/TokenSoftToken.sol
  • contracts/capabilities/Burnable.sol
  • contracts/roles/MinterRole.sol
  • contracts/capabilities/Pausable.sol
  • contracts/Migrations.sol
  • contracts/roles/WhitelisterRole.sol
  • contracts/capabilities/Whitelistable.sol
  • contracts/roles/PauserRole.sol
  • contracts/testing/TokenSoftTokenEscrowNotProxiable.sol
  • contracts/testing/Escrowable.sol
  • contracts/testing/EscrowerRole.sol
  • contracts/roles/RevokerRole.sol
  • contracts/roles/OwnerRole.sol
  • contracts/capabilities/Proxiable.sol
  • contracts/capabilities/Revocable.sol
  • contracts/testing/TokenSoftTokenEscrow.sol
  • contracts/Proxy.sol
  • contracts/capabilities/Mintable.sol
  • contracts/roles/BurnerRole.sol

Part of TokenSoft Token’s security record

TokenSoft Token
Audits1 audit by 1 firmLast audit Jun 2020, by Quantstamp.
Critical findingsNo open critical findingsIn 1 report.
Open TokenSoft Token’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us