Serum

Quantstamp7 Aug 2020Files named in the report

Audit

Quantstamp reviewed Serum on 7 Aug 2020: 4 findings, 0 critical; none marked fixed.

No open critical findings

Open the report Open Serum’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings4

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	0	0	0
Low	4	0	0

LowAllowance Double-Spend ExploitOpen

As it presently is constructed, the contract is vulnerable to the [allowance double-spend exploit](https://github.com/OpenZeppelin/openzeppelin-solidity/blob/b4f87bb8fc25fb07f73099701e39e167a3d36465/contracts/token/ERC20/ERC20.sol#L71-L78), as with other ERC20 tokens.

LowContract can be permanently left without a burner/minter/pauserOpen

All contracts inheriting from `BurnerRole` (directly or indirectly) may be permanently left without a burner; consequently, any operation dependent on the `onlyBurner` modifier will fail. Similar notes apply to miner and pauser roles.

LowPrivileged Roles and OwnershipOpen

Smart contracts will often have `owner` variables to designate the person with special privileges to make modifications to the smart contract. The contracts also employ pauser, minter, and burner roles. Although these roles are useful, they are trusted with a reasonable use of their privileges.

LowUnlocked PragmaOpen

Every Solidity file specifies in the header a version number of the format `pragma solidity (^)0.4.*`. The caret (`^`) before the version number implies an unlocked pragma, meaning that the compiler will use the specified version _and above_, hence the term "unlocked".