Taiko

QuillAudits4 Dec 2023Files named in the report

Audit · firm’s term: audit report

QuillAudits reviewed Taiko on 4 Dec 2023: 15 findings, 0 critical; 12 marked fixed, 3 open.

No open critical findings

Open the report Open Taiko’s security record

Report hosted on quillaudits.com.

Trustblock does not review code.

Findings15

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	0	4
Medium	0	0
Low	3	8

LowCheck __gaps have configure same size in all contractsOpen

__gap variable size is not equal to 50 in some contracts. Standard size (50) should be followed, having different sizes isn't logical it is more difficult to maintain the code.

LowMisleading commentsOpen

In EssentialContract.sol, __Essential_init() does not take any parameters unlike __Essential_init(address _addressManager) which initializes the AddressResolver contract with an address manager. The comment is incorrect and should be updated to match the code functionality. In LibAddress.sol, the sendEther function does not check for zero-value transactions as the comment implies. This could be a to-do left unimplemented in the code. In Bridge contract on L226-227 a comment states “Use the specified message gas limit if called by the owner, else use remaining gas” but in reality the specified gas in the message should be used if not called by the owner otherwise the remaining gas should be used if the caller is the owner.

LowReplace assert with requireOpen

_invokeMessageCall function in the contract uses assert to verify a condition, but this should not be used in deployment code as it is not a best practice to do.