Illuvium ERC20

Quantstamp19 Mar 2021Files named in the report

Quantstamp reviewed Illuvium (Illuvium ERC20) on 19 Mar 2021: 6 findings, 0 critical; 3 marked fixed, 2 acknowledged, 1 open.

No open critical findings

Open the report Open Illuvium’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings6

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	0	0	0
Low	1	2	3

Low`FeaturesUpdated` event is never usedFixed

`FeaturesUpdated` event defined in `AccessControl.sol` contract is never used. Instead, the `RoleUpdated` event is emitted when features are updated.

LowOff-by-one errorFixed

Signature expiration should occur at the block with timestamp specified by the `_exp` input parameter of the `delegateWithSig()` function. This means that at `block.timestamp == _exp` the signature should already be expired. However, the `require` statement on L1014 only throws if `block.timestamp > _exp`.

LowWrong underflow checkFixed

In L742-745, the checks are wrong. The check in L742 tests for overflow (instead of underflow), whereas the check in L745 allows to decrease by 0 (which contradicts the documentation).