Zora

Quantstamp17 Dec 2020Files named in the report

Audit

Quantstamp reviewed Zora on 17 Dec 2020: 12 findings, 0 critical; 4 marked fixed, 3 acknowledged, 5 open.

No open critical findings

Open the report Open Zora’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings12

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	1	1	1
Medium	1	0	0
Low	3	2	3

HighAvoidable Sell-on FeesFixed

The Zora team is already aware that sell-on fees can be (mostly) avoided and recommends accepting bids only from reputable buyers because of this. The problem giving rise to this issue is that asks are immediately processed when a bidder makes a suitable bid. Since anyone can make the bid, asks with a high sell-on fee can be accepted by non-reputable parties. **Update 2021-01-06:** The issue was fixed by removing sell-on fees from asks.

LowIncorrect `Media.onlyTokenCreated` ImplementationFixed

Line 159 should have a strict inequality instead.

LowIncorrect InterfaceFixed

The `mint` function has a different set of parameters.

LowRe-Entrancy from Untrusted ERC20 TokensFixed

Using untrusted ERC20 tokens opens up re-entrancy possibilities. Although we have not been able to identify a precise exploit, the logic in contracts `Market` and `Media` is complex enough to prevent us from having complete confidence these do not exist.