ZNS Token Upgrade

QuantstampFiles named in the report

Quantstamp reviewed ZNS Token Upgrade on 27 Oct 2023: 6 findings, 0 critical; 4 marked fixed, 2 acknowledged.

No open critical findings
Open the reportOpen ZNS Token Upgrade’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings6

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium000
Low024
LowAccessible Token Snapshot FunctionsFixed

Although the new implementation contract has removed snapshot functionalities during token transfers, it is still possible to access `ERC20SnapshotUpgradeable` public functions `balanceOfAt()` and `totalSupplyAt()`.

LowMissing Input ValidationFixed

It is crucial to validate inputs, even if the inputs come from trusted addresses, to avoid human error. A lack of robust input validation can only increase the likelihood and impact in the event of mistakes. Following is the list of places that can potentially benefit from stricter input validation: 1. qs-badge-fixed `MeowToken.sol#37`: the `amount` of the `transferBulk()` should be greater than zero. 2. qs-badge-fixed `MeowToken.sol#56`: the `amount` of the `transferFromBulk()` should be greater than zero.

LowUninitialized Implementation ContractFixed

The new implementation contains an initialize function that mints tokens to the initializer address. If minting is not needed and is used for testing only, the minting function should be removed from the initialize function. Otherwise, anyone can invoke the `initialize()` function of the implementation contract and mint arbitrary tokens. In general, leaving an implementation contract uninitialized can pose a security risk. To mitigate this risk, it is recommended to invoke the `_disableInitializers()` function in the constructor during deployment (see: [OpenZeppelin doc](https://docs.openzeppelin.com/upgrades-plugins/1.x/writing-upgradeable#initializing_the_implementation_contract)). This action will automatically lock the implementation contract, preventing any unauthorized usage.

LowUnlocked PragmaFixed

Every Solidity file specifies in the header a version number of the format `pragma solidity (^)0.8.*`. The caret (`^`) before the version number implies an unlocked pragma, meaning that the compiler will use the specified version *and above*, hence the term "unlocked".

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (1)

  • MeowToken.sol

Part of ZNS Token Upgrade’s security record

ZNS Token Upgrade
Audits2 audits by 1 firmLast audit Nov 2023, by Quantstamp.
Critical findingsNo open critical findingsAcross 2 reports.
Open ZNS Token Upgrade’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us