Audit Report

Paladin5 Nov 20229 addresses on Avalanche

Paladin reviewed Battle For Giostone (Audit Report) on 5 Nov 2022: 25 findings, 0 critical; 24 marked fixed, 1 open.

No open critical findings

Open the report Open Battle For Giostone’s security record

Report hosted on paladinsec.co.

Trustblock does not review code.

Findings25

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	3
Medium	0	0	2
Low	1	0	19

HighAn unexpectedly high amount of tokens can be allocated to team members, exceeding the actual contract balance, preventing them from withdrawing as the token transfer would failFixed

The report gives no description here.

HighContract will likely gridlock and prevent any further claiming with a large amount of users (~90+ recipients)Fixed

The report gives no description here.

HighThe contract will fully grid-lock and prevent all tokens from ever being withdrawn if no unlock has been made for just three days due to a literal being coerced into a uint8, causing an overflowFixed

The report gives no description here.

MediumRecipients who claim their whole allocation at the end of the vesting will receive less than expected and mess up the contract logic due to an overflow exceptionFixed

The report gives no description here.

MediumUsing uint16 for the vestingCycles variable type could potentially eventually gridlock the contractFixed

The report gives no description here.

LowaddWhiteList does not adhere to the checks-effect-interaction pattern and the owner could potentially withdraw more tokens than expected on TGEFixed

The report gives no description here.

LowClaiming delays a user their vesting schedule by up to 24 hours due to roundingFixed

The report gives no description here.

LowContract can theoretically be re-initialized once everyone withdrawsFixed

The report gives no description here.

LowContract owner is added as a member without any validation checkFixed

The report gives no description here.

LowContracts do owner management manuallyFixed

The report gives no description here.

Show 10 more

LowDivision before multiplication increases rounding error slightly within the function which calculates the amount of tokens to receiveFixed

The report gives no description here.

Lowinit function logic is also executed within allocate and therefore seems redundantFixed

The report gives no description here.

Lowitoken is privateFixed

The report gives no description here.

LowLack of safeTransfer usageFixed

The report gives no description here.

LowRecipients can instantly unlock their whole allocation through a reentrancy exploit if the token allows for reentrancyFixed

The report gives no description here.

LowThe contract pragmas are extremely wideFixed

The report gives no description here.

Lowtoken is never setFixed

The report gives no description here.

LowTypographical errorsFixed

The report gives no description here.

LowTypographical errors and gas optimizationsFixed

The report gives no description here.

LowTypographical errors and gas optimizationsFixed

The report gives no description here.

Show 4 more

LowTypographical errors and gas optimizationsFixed

The report gives no description here.

LowUnclear calc function name and parametersFixed

The report gives no description here.

LowVesting cycle business logic appears unnecessaryFixed

The report gives no description here.

LowWithdrawToMember function does not follow the checks-effects- interactions pattern, which would allow a single member to drain the contract if the itoken contract allows for reentrancyFixed

The report gives no description here.

Contracts in scope9

Address	Chain	Source code
0xf394effbb63c925f7b2533cec03cbca0311f597d	Chain: Avalanche	Source code: Verified source
0x872443a10843fff012ef75a2dac6fdc7f5580932	Chain: Avalanche	Source code: Verified source
0x70d2f5877ed1ae0af659a3aec46799568c8dcc2f	Chain: Avalanche	Source code: Verified source
0x4cfa9eca7317d099d447032f700f43e5ce2d30c3	Chain: Avalanche	Source code: Verified source
0xb7b608f6c3719ad61edfcc2f6c2fd5378940e859	Chain: Avalanche	Source code: Verified source
0x9973c0fff6e0c3ae683337e8b5760b2a0a437647	Chain: Avalanche	Source code: Verified source
0xea75db6b617e6d3375372b9fa2aaf49e5b01cc81	Chain: Avalanche	Source code: Verified source
0x69ae264162c32feffe1656751abd69ba76e2d306	Chain: Avalanche	Source code: Verified source
0x98a10009ce0c795ba8779e518fd115db6a902ece	Chain: Avalanche	Source code: Verified source

Part of Battle For Giostone’s security record

Battle For Giostone

Audits1 audit by 1 firmLast audit Nov 2022, by Paladin.

Critical findingsNo open critical findingsIn 1 report.

Open Battle For Giostone’s security record

Security firm

Paladin

176 projects reviewed · 241 reports · latest Apr 2025

See Paladin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.