Mantle Network (Token Migration)

Quantstamp16 Jun 2023Files named in the report

Quantstamp reviewed Mantle Network (Mantle Network (Token Migration)) on 16 Jun 2023: 6 findings, 0 critical; 3 marked fixed, 2 acknowledged, 1 open.

No open critical findings

Open the report Open Mantle Network’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings6

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	1
Medium	0	1	0
Low	1	1	2

HighAdherence To Specification: `BIT` Holders Might Get Less `MNT`Fixed

The [proposal in BitDAO](https://snapshot.org/#/bitdao.eth/proposal/0x950dac4d5715b8aa8eab29c484b1c9dd0eed161141262b0425874f65be4d9f8e) states: > “The one-way token conversion ratio shall be set at 1 $BIT token to 1 $MNT token”. However, the `MantleTokenMigrator` contract computes the ratio based on `TOKEN_CONVERSION_NUMERATOR` and `TOKEN_CONVERSION_DENOMINATOR`, possibly not guaranteeing the 1:1 ratio.

LowMissing Input ValidationFixed

It is important to validate inputs, even if they only come from trusted addresses, to avoid human error. The following is a non-exhaustive list of missing input validations: <br><br> 1. `MantleTokenMigrator.constructor()`: the `TOKEN_CONVERSION_NUMERATOR` has to be less than or equal to `TOKEN_CONVERSION_DENOMINATOR`. Additionally, the decimals of `BIT` and `MNT` tokens should be equal according to the NatSpec comments. 1. `MantleTokenMigrator.setTreasury()` needs a check against `address(0)`. Otherwise, the `defundContract()`, might just burn tokens.

LowUnnecessary `receive()` and `fallback()` FunctionalityFixed

`MantleTokenMigrator` contract implements `receive()` and `fallback()` functions. Based on the documentation and project use cases, the contract does not need to receive ETH at any point. The implementation of the functions also shows the Mantle team's intention: to make the transaction revert when receiving ETH in this contract.