Velar Vesting

QuillAudits26 Mar 2024Files named in the report

Audit · firm’s term: audit report

QuillAudits reviewed Velar (Velar Vesting) on 26 Mar 2024: 2 findings, 0 critical; none marked fixed.

No open critical findings

Open the report Open Velar’s security record

Report hosted on quillaudits.com.

Trustblock does not review code.

Findings2

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	0	0	0
Low	2	0	0

LowConsider using a fixed pragmaOpen

Avoid floating pragmas for non-library contracts.While floating pragmas make sense for libraries to allow them to be included with multiple different versions of applications, it may be a security risk for application implementations. A known vulnerable compiler version may accidentally be selected or security tools might fall back to an older compiler version, ending up checking a different EVM compilation that is ultimately deployed on the blockchain. It is recommended to pin to a concrete compiler version.

LowVesting Schedule Start Time can be set in PastOpen

There is no check whether startTimestamp is greater than block.timestamp in the constructor. Therefore, it is possible for administrators to accidentally create a vesting schedule that starts in the past without noticing it. When this happens, the vesting amount can be withdrawn, and the time limit will not be enforced.