Illuvium ERC20

Quantstamp19 Mar 2021Files named in the report

Quantstamp reviewed Illuvium (Illuvium ERC20) on 19 Mar 2021: 6 findings, 0 critical; 3 marked fixed, 2 acknowledged, 1 open.

No open critical findings

Open the report Open Illuvium’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings6

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	0	0	0
Low	1	2	3

LowPrivileged Roles and OwnershipAcknowledged

Smart contracts will often have `owner` variables (or other privileged roles) to designate the person with special privileges to make modifications to the smart contract. The following privileged roles and capabilities exist in the system: 1. `ROLE_TOKEN_CREATOR` can mint arbitrary amounts of ILV to any account at any time. 2. `ROLE_TOKEN_DESTROYER` can burn arbitrary amount of ILV from any account at any time.

LowUnsafe way to check if address is contract or EOAAcknowledged

The way in which `safeTransfer()` checks whether the `_to` address is a contract or an EOA is not always safe, because it uses the `extcodesize` instruction, which returns 0 indicating an EOA, when it is called from the `constructor()` of the `_to` address. This would effectively allow transferring ILV to a contract which is not a valid `ERC20Receiver` via the `safeTransferFrom()` function.