We have reviewed the code, documentation, and test suite and found several issues of various severities. Overall, we consider the code to be well-written but with insufficient documentation and a good test suite that can be improved given suggested changes from this report. We have outlined suggestions to better follow best practices, and recommend addressing all the findings to tighten the contracts for future deployments or contract updates. We recommend addressing all the **12** findings to harden the contracts for future deployments or contract updates. We recommend against deploying the code as-is. <br/> **Update:** Quantstamp has audited the changes based on the commit for the `saddle-token` repository ([617d17f](https://github.com/saddle-finance/saddle-token/pulls?q=is%3Apr+is%3Aclosed+qsp)). Of the original 12 issues, all 12 have been either fixed, acknowledged, or mitigated.
Low | Medium | High | Critical | Total | |
---|---|---|---|---|---|
Not fixed | 2 | - | - | - | 2 |
Fixed | 10 | - | - | - | 10 |
Total | 12 | 0 | 0 | 0 | 12 |
# | File Name |
---|---|
1 | contracts/Vesting.sol |
2 | contracts/helper/GenericERC20WithGovernance.sol |
3 | contracts/SimpleGovernance.sol |
4 | contracts/helper/Cloner.sol |
5 | contracts/RetroactiveVesting.sol |
6 | contracts/SDL.sol |