Quantstamp reviewed TokenSoft Token on 16 Jun 2020: 5 findings, 0 critical; 2 marked fixed, 3 acknowledged.
Report hosted on certificate.quantstamp.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 1 | 0 |
| Low | 0 | 2 | 2 |
Smart contracts will often have `Owner` variables to designate the person with special privileges to make modifications to the smart contract. Currently, the `Owner` role can add/remove other roles as well as other owners. Moreover, the `Revoker` role can transfer funds between users readily, which may be a dangerous privilege. If these privileged members lose their private keys, regular users may suffer from lost funds and unexpected behaviour.
As it presently is constructed, the contract is vulnerable to the [allowance double-spend exploit](https://github.com/OpenZeppelin/openzeppelin-solidity/blob/b4f87bb8fc25fb07f73099701e39e167a3d36465/contracts/token/ERC20/ERC20.sol#L71-L78), as with other ERC20 tokens.
In the constructor of `Proxy.sol`there is no verification as to whether or not `contractLogic` contains code. This creates a risk for human errors were during the `Proxy` contract deployment where an arbitrary externally owned account may be stored instead of a contract account inside the proxy. Furthermore, executing transactions on a non-contract address will not throw any errors, which can be problematic.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (20)
236 projects reviewed · 332 reports · latest Oct 2026
See Quantstamp’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us