Fabric CrowdFinancing 2

Quantstamp17 Apr 2023Files named in the report

Quantstamp reviewed Fabric CrowdFinancing 2 on 17 Apr 2023: 10 findings, 0 critical; 6 marked fixed, 2 acknowledged, 2 open.

No open critical findings

Open the report Open Fabric CrowdFinancing 2’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings10

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	1
Medium	0	0	1
Low	2	2	4

LowCampaign Recipient Incentivized to Contribute to SelfAcknowledged

Supposing a low `transferFee`, then the recipient of the contributions would be incentivized to contribute to themselves since they will receive their own contributions back regardless of the outcome, and, if the funding succeeds, they will also receive the yield on their funds. They would be especially incentivized to fund themselves if the funding is close to failing or finishing, to profit off the yield, or to artificially change the crowdfunding campaign's state to `FUNDED` in order to receive the contributions of others. Note that they will immediately be able to withdraw their contributions, so there is very little cost to such a manipulation.

LowContribution Can Revert Due to Exceeding the Maximum GoalAcknowledged

If the raised amount is close to reaching the maximum goal, the final call to either `contributeERC20()` or `contributeETH()` function may revert. This is because the last requirement in `contributionGuard()` may not be met, since the deposited amount may exceed the maximum goal set for the contract.