LiquiFi

QuantstampFiles named in the report

Quantstamp reviewed LiquiFi on 27 Jan 2022: 21 findings, 0 critical; 18 marked fixed, 1 acknowledged, 2 open.

No open critical findings
Open the reportOpen LiquiFi’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings21

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High002
Medium011
Low2015
Low`createVestPlan` Missing Input ValidationOpen

The `createVestPlan` function is the main entry point to creating a vesting plan. It makes implicit assumptions on the input parameters that are not enforced by the contract, which can lead to mistakes such as accidentally sending additional funds.

LowEvents Not Emitted on State ChangeOpen

An event should always be emitted when a state change is performed in order to facilitate smart contract monitoring by other systems which want to integrate with the smart contract. This is not the case for the functions and the correspondingly modified state variables: 1. `CliffModule.setVestingController()`, after changing `vestingControllerAddress`. 2. `CliffModule.createPlan()`, after changing `cliffPlans[]`. 3. `CliffModule.release()`, after changing `cliffPlans[]`. 4. `LinearModule.setVestingController()`, after changing `vestingControllerAddress`. 5. `LinearModule.createPlan()`, after changing `linearPlans[]`. 6. `LinearModule.release()`, after changing `linearPlans[]`. 7. `StreamModule.setVestingController()`, after changing `vestingControllerAddress`. 8. `StreamModule.createPlan()`, after changing `streamPlans[]`. 9. `StreamModule.release()`, after changing `streamPlans[]`. 10. `EmployeeRegistry.addOwner()`, after changing `companyOwners`, and `companyId`. 11. `EmployeeRegistry.addEmployee()`, after changing `companyIdToEmployees[]` and `employeeToCompanyIds`. 12. `EmployeeRegistry.transferOwner()`, after changing `companyOwners`. 13. `EmployeeRegistry.archiveEmployee()`, after changing `companyIdToEmployees[]`. 14. `Escrow.deposit()`, after changing `escrowBalance[][]`. 15. `Escrow.withdraw()`, after changing `escrowBalance[][]`.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (8)

  • contracts/modules/BaseModule.sol
  • contracts/employee/EmployeeRegistry.sol
  • contracts/modules/LinearModule.sol
  • contracts/vesting/Vesting.sol
  • contracts/modules/CliffModule.sol
  • contracts/escrow/Escrow.sol
  • contracts/lib/Utils.sol
  • contracts/modules/StreamModule.sol

Part of LiquiFi’s security record

LiquiFi
Audits1 audit by 1 firmLast audit Jan 2022, by Quantstamp.
Critical findingsNo open critical findingsIn 1 report.
Open LiquiFi’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us