Demex

QuillAudits1 Aug 2024Files named in the report

Audit · firm’s term: audit report

QuillAudits reviewed Demex on 1 Aug 2024: 4 findings, 0 critical; all marked fixed.

No open critical findings

Open the report Open Demex’s security record

Report hosted on quillaudits.com.

Trustblock does not review code.

Findings4

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	1
Medium	0	0	2
Low	0	0	1

HighChange of name in CarbonWrappedERC20 does not update the DOMAIN_SEPARATOR causing invalid permits.Fixed

This function is used to update the token name, however a serious issue arises when this happens.This contract inherits the solmate ERC20 contract, which initializes the domain separator in the constructor. One key part of the domain separator being the name , hence when the name is changed, the INITIAL_DOMAIN_SEPARATOR would now be invalid. Hence the permit functionality will be permanently bricked.

MediumCarbonWrappedERC20 does not implement the pausability inherited from CarbonGenericAccessControlFixed

The CarbonWrappedERC20 inherits the pause functionality from the CarbonGenericAccessControl, however it has a few issues:• It does not set the pauser in __token_control_init() • It does not implement the whenNotPaused and whenPaused modifiers in any of its functions.

MediumUse onlyInitializing instead of initializer for parent contractsFixed

According to the Open Zeppelin Docs the initializer should be used in the child contract that has inherited the parent contracts, meanwhile the inherited contracts should use the onlyInitializing. However this is not done here, instead the parent contract and child contract all use the initializer modifier.

LowLack of event for multiple contractsFixed

In the contracts listed above, there are multiple events lacking in important functions. It is important to emit events in vital protocol functions.