Ramp Network

Quantstamp30 Aug 2019Files named in the report

Audit

Quantstamp reviewed Ramp Network on 30 Aug 2019: 4 findings, 0 critical; 2 marked fixed, 2 open.

No open critical findings

Open the report Open Ramp Network’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings4

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	0	0
Medium	0	0
Low	2	2

Lowcreate() has no checks ensuring that the token address stored in _assetData actually corresponds with the _poolFixed

Although create() can only be called by designated swap creator, the function does not check that the token address stored in _assetData corresponds with the the one in stored in _pool. Exploit Scenario: It is possible for the swap creator to submit an invalid swap that indicates "Token1" in the asset data, but the transferred funds are of type "Token2".

LowFunctions never check the length of assetDataFixed

The following parts of smart contracts use assembly code to read data from the argument assetData: • AssetAdapter.checkAssetType(); • EthAdapter.getAmount(); • TokenAdapter.getAmount() and TokenAdapter.getTokenAddress(). Although it is implicitly assumed that the operator submits well-formed assetData, contracts never verify this assumption (e.g., the length of assetData is never checked before use).