ParagonsDAO - Sleeves

Quantstamp8 Nov 2023Files named in the report

Quantstamp reviewed Paragons (ParagonsDAO - Sleeves) on 8 Nov 2023: 12 findings, 0 critical; 9 marked fixed, 3 acknowledged.

No open critical findings

Open the report Open Paragons’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings12

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	0	0
High	0	2
Medium	0	1
Low	3	6

LowInteraction with External ContractsAcknowledged

The protocol relies on the functionalities of external contracts. Therefore, the security of the project depends on these contracts. While we are unaware of any immediate issues, it is important to note that DeFi protocols may be vulnerable to flash loan attacks, market manipulation, computational errors, etc.

LowPotential Malfunction in Admin-Controlled FunctionsAcknowledged

For `Sleeves.adminUnsleeveBatch()` and `adminWithdrawWithProofBatch()` to execute successfully, the user must have previously approved `PDT` token to be spent by the `Sleeves` contract.

LowPrivileged Roles and OwnershipAcknowledged

Smart contracts will often have owner variables to designate the person with special privileges to make modifications to the smart contract. - `Sleeves.adminSetRarityScores()` lets the admin alter `rarityScore` post-sleeving, affecting `_unsleeveBatch` fees. - `Sleeves.adminSleeveBatch()` enables admins to seize balances and deposit to `Sleeves` from users that pre-approved token transfer to the `Sleeves` contract. - `Sleeves.adminUnsleeveBatch()` and `adminWithdrawWithProofBatch()` permit admins to unsleeve/withdraw user assets, deducting PDT fees from user balances. - `Sleeves.adminClaimPrime()` grants admins the ability to claim rewards and redirect them to any chosen address, compromising transparent asset distribution to users. - `Sleeves.adminSetUnsleeveBaseFee()` gives the admin unrestricted power to set unsleeving fees.