qiibee - Token Sale

CertiK10 Sep 2024Files named in the report

CertiK reviewed qiibee foundation $QBX (qiibee - Token Sale) on 10 Sep 2024: 6 findings, 1 critical; 3 marked fixed, 1 acknowledged, 2 open.

1 open critical finding

Open the report Open qiibee foundation $QBX’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings6

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	1	0	0
High	0	1	0
Medium	0	0	0
Low	1	0	3

LowDiscussion on `setEndTime` functionFixed

In the `setEndTime()` function, `endTime` can only be updated when `uint64(block.timestamp) > endTime`, indicating the token sale has ended. However, changing the `endTime` value to a smaller value `_endTime` after the token sale has concluded does not affect the status of the sale, as it remains ended.

LowInadequate Validation of Raffle Time Parameters iFixed

The constructor in the `Raffle` contract fails to ensure that the `startTime` is set in the future relative to the current `block.timestamp` and that `endTime` is greater than `startTime`. This oversight can lead to scenarios where the raffle is incorrectly initialized, potentially allowing immediate closure or incorrect operation of the raffle. ```solidity constructor( uint64 _startTime, uint64 _endTime, uint64 _ownerWithdrawAfter ) Ownable(msg.sender) { startTime = _startTime; endTime = _endTime; ownerWithdrawAfter = endTime + (_ownerWithdrawAfter * 1 days); allowWithdrawals = false; } ```

LowUnused Return ValueFixed

The smart contract does not check or store the return value of an external call in a local or state variable, which may introduce vulnerabilities due to the unhandled outcome. ```solidity=160 targetContract.setWinnersAndWithdrawFunds(transaction.winners, transaction.amountList); ```