31Third

Quantstamp1 Mar 2023Files named in the report

Audit

Quantstamp reviewed 31Third on 1 Mar 2023: 15 findings, 0 critical; 9 marked fixed, 4 acknowledged, 2 open.

No open critical findings

Open the report Open 31Third’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings15

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	1
Medium	0	0	2
Low	2	4	6

LowMissing Input ValidationOpen

It is vital to validate inputs to avoid human error, even if they only come from trusted addresses. The following functions do not have a proper validation of input parameters: 1. qs-badge-fixed `BatchTrade.batchTrade()` accepts trades with the same asset in `from` and `to` fields. 2. qs-badge-fixed `ExchangeAdapterRegistry.addAdapter()` should check that `name` is not an empty string. 3. qs-badge-mitigated Fees are calculated with a constant denominator of `10000`, however, the assignment of `maxFeeBasisPoints` does not consider this constant denominator when it is being assigned. This could lead to a scenario where `maxFeeBasisPoints` either meets or exceeds `10000`. 4. qs-badge-fixed `updateFeeRecipient()` and `updateBasisPoints()` do not check that the new value being assigned is actually different than the existing one. This could lead to unnecessary transaction costs.

LowUntraceable Contract EventsOpen

Events should be emitted when the contract state changes. The following functions in `BatchTrade` do not emit events: - `updateFeeRecipient()` - `updateBasisPoints()` - `reduceMaxBasisPoints()` - `addFeelessWallet()` - `removeFeelessWallet()` - `receiveFees()`