NFTSpace

QuillAudits28 Feb 2024Files named in the report

Audit · firm’s term: audit report

QuillAudits reviewed NFTSpace on 28 Feb 2024: 4 findings, 0 critical; all marked fixed.

No open critical findings

Open the report Open NFTSpace’s security record

Report hosted on quillaudits.com.

Trustblock does not review code.

Findings4

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	0	0	1
Low	0	0	3

MediumMinting totalsupply without decimalsFixed

intialize() mints 1_000_000_000 (totalsupply) to msg.sender. But here 1_000_000_000 is getting specified without decimals. This can create problem when user/owner will assume they got 1_000_000_000e18 and they will try to transfer amount with decimals e.g 100e18 ( 100000000000000000000) but because only 1_000_000_000 got minted to owner’s account, it will fail. It should be changed to 1_000_000_000e18 if the value without decimals is not the intended one.

Low_disableInitializers() should be called in the contstructorFixed

In the proxy implementations _disableInitializers() should be called in the constructors. If not added, malicious users/address can call initialize() on the implementation smart contract where they would be able to set certain things that initialize() allows to set.The severity of impact depends on the contract logic, but it's a good practice to add _disableInitializers() call in the implementation logic.

LowComment can be removedFixed

Contract contains “// Additional functions and logic specific to your token can be added here” comment. This comment can be removed before deploying as a good practice.

LowUsing floating pragmaFixed

token.sol is not using a fixed solidity version. It’s using floating pragma (pragma solidity ^0.8.21), Contracts should be deployed with the same compiler version and flags that they have been tested thoroughly. Using floating pragma does not ensure that the contracts will be deployed with the same version. It is possible that the most recent compiler version gets selected while deploying a contract which has a higher chance of having bugs in it.