Ampleforth

Quantstamp13 Jun 2019Files named in the report

Audit

Quantstamp reviewed AMPL (Ampleforth) on 13 Jun 2019: 8 findings, 0 critical; 6 marked fixed, 2 open.

No open critical findings

Open the report Open AMPL’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings8

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	0	0
Medium	0	0
Low	2	6

LowBlock Timestamp ManipulationOpen

Projects may rely on block timestamps for various purposes. However, it's important to realize that miners individually set the timestamp of a block, and attackers may be able to manipulate timestamps for their own purposes. If a smart contract relies on a timestamp, it must take this into account.

Lowgon balances may become untransferable over timeOpen

The functions transfer() and transferFrom() take value that signifies the number of tokens to transfer. Both functions compute the corresponding number of gons and use them to update the ledger. It is possible that the value of _gonsPerFragment becomes large enough (due to constantly increasing target rate) so that gonValue exceeds the account balance even if value equals 1. Such a transfer will fail on SafeMath.sub(). Consequently, the source account will have a non-zero gon balance that will be untransferable. Theoretically, a large number of gons can be dispersed among multiple accounts in too low quantities, so all those gons will become unspendable.