Naos-Formation

Quantstamp28 May 2021Files named in the report

Quantstamp reviewed NAOS (Naos-Formation) on 28 May 2021: 16 findings, 0 critical; 12 marked fixed, 3 acknowledged, 1 open.

No open critical findings

Open the report Open NAOS’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings16

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	1	1	1
Low	0	2	11

MediumUnchecked Return ValueAcknowledged

Most functions will return a `true` or `false` value upon success. Some functions, like `send()`, are more crucial to check than others. It's important to ensure that every relevant function is checked. * in `YearnVaultAdapter.sol`, L63, 73: return value not checked

LowEconomic attack vector exists due to `flush()`Acknowledged

As "flush" pushes the funds from Formation to the underlying vault, this forces an exchange of assets from underlying token to the external vault's share token. To be safe from economic exploits, it is essential that the share price of the vault cannot be manipulated in a single transaction.

LowPrivileged Roles and OwnershipAcknowledged

Smart contracts will often have `owner` variables to designate the person with special privileges to make modifications to the smart contract. The governance of the system holds significant amount of power. For example, through governance, it is possible to mint infinite amount of NTokens and Naos. 1. In `NAOSToken` and `TimeToken.sol`, the minter may mint tokens arbitrarily. 2. In `StakingPools`, the governance may set arbitrary minting rates and proportions for each pool. 3. In `Transmuter.distribute`, any whitelisted address can transfer tokens into the buffer from any other address that has approved the `Transmuter` contract. 4. In `Formation.sol`, the governance can set important addresses such as the `oracle`, `transmuter` or `rewards`, which in the worst case could steal all funds.