Mantle Network (Token Migration)

Quantstamp16 Jun 2023Files named in the report

Quantstamp reviewed Mantle Network (Mantle Network (Token Migration)) on 16 Jun 2023: 6 findings, 0 critical; 3 marked fixed, 2 acknowledged, 1 open.

No open critical findings

Open the report Open Mantle Network’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings6

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	1
Medium	0	1	0
Low	1	1	2

MediumDefund Protection BypassedAcknowledged

`defundContract()` can be used by the owner of the contract to transfer the funds from the migrator contract to the `treasury` address. However, the owner can just change the `treasury` variable with the same privileges and therefore transfer the funds to an arbitrary address.

LowOwnership Can Be RenouncedAcknowledged

If the owner renounces their ownership, or the ownership is transferred to the wrong address, all ownable contracts will be left without an owner. During the audit, the auditing team found the following issues: 1. `L1MantleToken`: - `OwnableUpgradeable` from OpenZeppelin implements `renounceOwnership()` function. If the contract owner calls this function, all the functions guarded by `onlyOwner` will no longer be able to be executed. - `OwnableUpgradeable` implements `transferOwnership()`. If the new owner address is wrong or not controlled by the team, access to privileged functions (`onlyOwner`) will be lost forever. 2. `MantleTokenMigrator`: - This contract implements a custom function for transferring the contract ownership: `transferOwnership()`. If the new `owner` address is wrong or not controlled by the team, access to privileged functions (`onlyOwner`) will be lost forever.