Epoch Island - vEPOCH Token

Quantstamp3 Nov 2023Files named in the report

Quantstamp reviewed Epoch Island (Epoch Island - vEPOCH Token) on 3 Nov 2023: 18 findings, 0 critical; 4 marked fixed, 12 acknowledged, 2 open.

No open critical findings

Open the report Open Epoch Island’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings18

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	1
Medium	0	1	1
Low	2	11	2

LowGas ImprovementsOpen

We identified some code sections where gas usage could be improved: 1. `Vepoch.sol#L156` and `L160`: Consider caching the return value of the call to `calculateVeTokens(_tokenAmount, _duration)` in a new local variable and re-using it instead of having two calls. 1. `deposits` is currently a mapping. As it is used with a strictly incrementing index, an array can also be used. Storing new values in an array is cheaper than in a mapping.

LowRounding Errors Could Be Intentionally Introduced to Keep the `rewardStakingPower`Open

In `withdrawForfeit()`, the deposit is never deleted even when `percentage` is 100%. So an attacker could call `withdrawForfeit()` multiple times and pass in engineered numbers of `_depositTokensToRemove` to deliberately introduce rounding errors that allow the contract to return all of the deposited tokens while keeping some dust `rewardStakingPower` inside the contract. If this happens, the attacker can be rewarded without keeping any deposits in the contract.