Reflexer Staking and Auction House

Quantstamp9 Jul 2021Files named in the report

Quantstamp reviewed Reflexer (Reflexer Staking and Auction House) on 9 Jul 2021: 8 findings, 0 critical; 2 marked fixed, 6 acknowledged.

No open critical findings

Open the report Open Reflexer’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings8

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	0	0
High	0	1
Medium	0	0
Low	6	1

Low`restartAuction()` Doesn’t Check if the Contract Is EnabledAcknowledged

The function `restartAuction()` works even when the contract is not enabled (unlike other methods). Also, it can be called by anyone (no authorization checks).

LowAnyone Can Terminate Ongoing Auctions via `terminateAuctionPrematurely()`Acknowledged

`terminateAuctionPrematurely()` has no authorization in place. A user can pay the fees and stop an auction by sending staked tokens to the token burner contract. This can increase the staked token value by burning a number of such tokens compensating the paid ETH value for gas.

LowCan Lock Into Zero Authorized AdressesAcknowledged

In both contracts, as an authorized address can remove its own address from the `authorizedAccounts` mapping, you can get locked by mistake or malicious intention into a state with zero authorized accounts.

LowEvery Exit Request Postpones the Deadline FurtherAcknowledged

On every `requestExit` the deadline is pushed by the `exitDelay` value. Assuming an `exitDely` of 1 day, if a user submits an `exitRequest` today and another one day after, the earliest day to call `exit()` would be two days after the initial call.

LowManipulable Auction DeadlinesAcknowledged

The contract allows authorized users to change `totalAuctionLength`, which sets the deadline for auctions by adding it to the current datetime (`now`). The authorized users can set the length to an arbitrarily small value, which could potentially let short-length auctions be won by accounts benefiting the authorized users. More importantly, the datetime (`now`) can be potentially manipulated by the miners. So, every time there is a lucrative auction, miners are incentivized to supply smaller or larger values, depending on the auction state, for the datetime (`now`).

LowPrivileged Roles and OwnershipAcknowledged

Smart contracts will often have `owner` variables or authorized accounts to designate persons with special privileges to make modifications to the smart contract.