Quadrata Lending

QuantstampFiles named in the report

Audit

Quantstamp reviewed Quadrata (Quadrata Lending) on 21 Mar 2023: 11 findings, 0 critical; 5 marked fixed, 6 open.

No open critical findings
Open the reportOpen Quadrata’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings11

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High300
Medium000
Low305
Low`_addReserves()` function not AML-checkedFixed

One of the goals of this fork was in protecting protocol interactions (supplying funds, borrowing, repaying) with AML (Anti-Money Laundering) score checks, as performed through the `QuadPassport.sol`-related contracts. However, it is still possible to supply funds to the pools through the `_addReserves()` functions, as exposed through `CErc20.sol` and `CEther.sol` to `CToken.sol`. While internally these funds are treated separately as part of the `totalReserves` from the usable funds and can only be used to be passed through to the `admin` address through `Ctoken._reduceReserves()` by the admin, it is unclear if it remains AML-unchecked on purpose or not.

LowApplication Monitoring Can Be Improved by Emitting More EventsFixed

In order to validate the proper deployment and initialization of the contracts, it is a good practice to emit events. Also, any important state transition can be logged, which is beneficial for monitoring the contract and also tracking any eventual bugs or potential hacks. Below we present a non-exhaustive list of events that could be emitted to improve the application management: 1. `ComptrollerG7._setQuadReader()` does not emit an event reflecting changes made to the state variable `reader`. 1. `UniswapAnchoredViewProxy.setUniswapAnchoredView()` does not emit an event reflecting changes made to the state variable `uav`. 1. `UniswapAnchoredViewProxy.setTargetDecimals()` does not emit an event reflecting changes made to the state variable `targetDecimals`. 1. `UniswapAnchoredViewProxy.setPriceDecimals()` does not emit an event reflecting changes made to the state variable `priceDecimals`.

LowHard Coded `_tokenId` ParameterFixed

In function `CToken.getHighestAMLScore()` a call is made to `getAttributesFree()` of the `QuadReader.sol` contract, where the second parameter, `_tokenId`, is provided as a hard coded `1`. However, while currently `1` is the default, there exists functionality for adding/changing eligible IDs, through `QuadGovernance.setEligibleTokenId()`. Therefore making the current setup on the `CToken.sol` side not future-proof.

LowInteger Overflow / UnderflowFixed

Integer overflow/underflow occur when an integer hits its bit-size limit. Every integer has a set range; when that range is passed, the value loops back around. A clock is a good analogy: at 11:59, the minute hand goes to 0, not 60, because 59 is the largest possible minute. <br><br> No overflow check for the variable `value` in function `UniswapAnchoredViewProxy.scalePriceInternal(...)`. The code is reproduced below. ```javascript= function scalePriceInternal(uint248 value) internal view returns(uint248) { int256 mantissa = int256(targetDecimals) - int256(priceDecimals); bool signed = mantissa > 0; if(!signed) { mantissa *= -1; } if(signed) { value *= (10 ** uint248(mantissa)); } else { value /= (10 ** uint248(mantissa)); } return uint248(value); } ```

LowTest Code Mixed With Production CodeFixed

To prevent confusion and potentially introduce vulnerabilities, test code should not be present in production code/should be clearly separated. In this regard, contract `SimplePriceOracle.sol` constitutes an oracle test contract (as prices can be set arbitrarily by anyone manually) and should therefore be moved into a dedicated `test` or `mock` folder.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (88)

  • contracts/test-contracts/ComptrollerScenario.sol
  • contracts/SafeMath248.sol
  • contracts/CErc20Delegator.sol
  • contracts/test-contracts/upgradability-tests/ComptrollerG3.sol
  • contracts/test-contracts/FixedPriceOracle.sol
  • contracts/CEther.sol
  • contracts/test-contracts/FaucetToken.sol
  • contracts/test-contracts/Passport/ERC1155/IERC1155ReceiverUpgradeable.sol
  • contracts/test-contracts/Passport/ERC1155/presets/ERC1155PresetMinterPauserUpgradeable.sol
  • contracts/Exponential.sol
  • contracts/LegacyJumpRateModelV2.sol
  • contracts/test-contracts/Passport/ERC1155/extensions/ERC1155BurnableUpgradeable.sol
  • contracts/test-contracts/Passport/storage/QuadPassportStore.sol
  • contracts/WhitePaperInterestRateModel.sol
  • contracts/UniswapAnchoredViewProxy.sol
  • contracts/UniswapAnchoredViewInterface.sol
  • contracts/test-contracts/Const.sol
  • contracts/test-contracts/Structs.sol
  • contracts/test-contracts/Passport/ERC1155/extensions/ERC1155PausableUpgradeable.sol
  • contracts/test-contracts/Passport/ERC1155/IERC1155Upgradeable.sol
  • contracts/Reservoir.sol
  • contracts/Unitroller.sol
  • contracts/test-contracts/Passport/UAVMock/UniswapAnchoredViewV2Mock.sol
  • contracts/test-contracts/Fauceteer.sol
  • contracts/test-contracts/CEtherV2Test.sol
  • contracts/test-contracts/Passport/interfaces/IQuadPassport.sol
  • contracts/test-contracts/Passport/ERC1155/utils/ERC1155ReceiverUpgradeable.sol
  • contracts/CToken.sol
  • contracts/ExponentialNoError.sol
  • contracts/test-contracts/Passport/interfaces/IQuadGovernance.sol
  • contracts/CErc20Delegate.sol
  • contracts/test-contracts/Counter.sol
  • contracts/test-contracts/Passport/QuadPassport.sol
  • contracts/test-contracts/PriceOracleProxy.sol
  • contracts/test-contracts/upgradability-tests/ComptrollerScenarioG3.sol
  • contracts/ComptrollerStorage.sol
  • contracts/test-contracts/Passport/QuadGovernance.sol
  • contracts/test-contracts/Passport/interfaces/IUniswapAnchoredView.sol
  • contracts/test-contracts/ComptrollerHarness.sol
  • contracts/test-contracts/Passport/ERC1155/ERC1155Upgradeable.sol
  • contracts/JumpRateModelV2.sol
  • contracts/test-contracts/UniswapAnchoredViewProxyHarness.sol
  • contracts/test-contracts/upgradability-tests/Comptroller.sol
  • contracts/test-contracts/Passport/ERC1155/utils/ERC1155HolderUpgradeable.sol
  • contracts/test-contracts/upgradability-tests/ComptrollerScenarioG1.sol
  • contracts/LegacyInterestRateModel.sol
  • contracts/InterestRateModel.sol
  • contracts/test-contracts/InterestRateModelHarness.sol
  • contracts/CErc20.sol
  • contracts/CarefulMath.sol
  • contracts/test-contracts/FalseMarker.sol
  • contracts/test-contracts/Passport/ERC1155/extensions/ERC1155SupplyUpgradeable.sol
  • contracts/test-contracts/upgradability-tests/ComptrollerG1.sol
  • contracts/test-contracts/MathHelpers.sol
  • contracts/ComptrollerInterface.sol
  • contracts/CDaiDelegate.sol
  • contracts/ErrorReporter.sol
  • contracts/test-contracts/Passport/UAVMock/UniswapAnchoredViewV3Mock.sol
  • contracts/test-contracts/ERC20.sol
  • contracts/test-contracts/upgradability-tests/ComptrollerScenarioG2.sol
  • contracts/Timelock.sol
  • contracts/BaseJumpRateModelV2.sol
  • contracts/test-contracts/Passport/storage/QuadReaderStore.sol
  • contracts/test-contracts/CErc20Harness.sol
  • contracts/ComptrollerG7.sol
  • contracts/test-contracts/EvilToken.sol
  • contracts/test-contracts/CEtherHarness.sol
  • contracts/test-contracts/Passport/interfaces/IQuadReader.sol
  • contracts/CTokenInterfaces.sol
  • contracts/EIP20Interface.sol
  • contracts/test-contracts/Passport/ERC1155/extensions/IERC1155MetadataURIUpgradeable.sol
  • contracts/SafeMath.sol
  • contracts/test-contracts/Passport/QuadReader.sol
  • contracts/EIP20NonStandardInterface.sol
  • contracts/test-contracts/Maximillion.sol
  • contracts/test-contracts/TimelockHarness.sol
  • contracts/test-contracts/SimplePriceOracle.sol
  • contracts/test-contracts/TetherInterface.sol
  • contracts/test-contracts/Passport/UAVMock/UniswapAnchoredViewMock.sol
  • contracts/JumpRateModel.sol
  • contracts/test-contracts/FeeToken.sol
  • contracts/DAIInterestRateModelV3.sol
  • contracts/CErc20Immutable.sol
  • contracts/test-contracts/upgradability-tests/ComptrollerG2.sol
  • contracts/test-contracts/MockMCD.sol
  • contracts/PriceOracle.sol
  • contracts/Passport/IQuadReader.sol
  • contracts/test-contracts/Passport/storage/QuadGovernanceStore.sol

Part of Quadrata’s security record

Quadrata
Audits3 audits by 2 firmsLast audit Jul 2023, by CertiK.
Critical findingsNo open critical findingsAcross 3 reports.
Open Quadrata’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us