Fabric CrowdFinancing 2

Quantstamp17 Apr 2023Files named in the report

Quantstamp reviewed Fabric CrowdFinancing 2 on 17 Apr 2023: 10 findings, 0 critical; 6 marked fixed, 2 acknowledged, 2 open.

No open critical findings

Open the report Open Fabric CrowdFinancing 2’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings10

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	1
Medium	0	0	1
Low	2	2	4

LowAllowance Double-Spend ExploitOpen

As it presently is constructed, the contract is vulnerable to the [allowance double-spend exploit](https://github.com/comitylabs/openzeppelin-contracts/blob/6bd6b76d1156e20e45d1016f355d154141c7e5b9/contracts/token/ERC20/IERC20.sol#L43), as with other ERC20 tokens.

LowMalicious Fee or Transfer Recipient Can Block TransferOpen

When transferring ether, one of the fee or transfer recipients may implement a contract with a malicious `fallback()` or `receive()` function, which could cause a denial of service in several ways: * Consume all remaining gas. * Revert when called. * Return `false`. Note that the likelihood of such an attack is minimal as it goes against the financial incentives of the attacker. However, if one of the two actors is malicious, then the other one will be unable to retrieve their funds.