Reflexer Staking and Auction House

Quantstamp9 Jul 2021Files named in the report

Quantstamp reviewed Reflexer (Reflexer Staking and Auction House) on 9 Jul 2021: 8 findings, 0 critical; 2 marked fixed, 6 acknowledged.

No open critical findings

Open the report Open Reflexer’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings8

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	0	0
High	0	1
Medium	0	0
Low	6	1

HighUnsafe Transfers Could Lead to Fund LossesFixed

The `StakedTokenAuctionHouse` contract uses the function `transferFrom()` in an unsafe manner since the return value is unchecked in lines 305 and 333. In case that the transfer fails the transaction proceeds assuming that the transfer went through. This could potentially lead to fund losses for the user or the contract. The same problem materialises in the `GebLenderFirstResortRewards.sol` contract. It does not check the return value of two `transfer` calls: * `transfer()` in `GebLenderFirstResortRewards` on L429 * `transfer()` in `GebLenderFirstResortRewards` on L473

LowMissing Input ValidationFixed

Arguments of type address are not checked to be non-zero in `TokenPool.constructor()`. Furthermore, the function `modifyParameters()` can potentially set invalid addresses to sensitive variables `accountingEngine` and `tokenBurner`. Also, `minBidDecrease` can be set to zero leading to `newMinBid` being always set to 1 in `restartAuction()`.