Gitcoin Toke Security Smart Contract Audit

Summary

Executive Summary This report presents the results of our engagement with Gitcoin to review GTC Token Distribution and Governance. The review was conducted over two weeks, from April 19, 2021 to April 30, 2021 by Shayan Eskandari and Daniel Luca. A total of 20 person-days were spent. Scope Our review focused the smart contract files for governance on the commit hash ee5e45a008d65021831de9f3e83053026f2a4dd2 and the Ethereum Signed Message Service (ESMS) repository on the commit hash 5eb22e882e28e6f3192b80f237f7a3bcd15b1ee9.

Project

Gitcoin

Multi-Chain

No active critical issues

Last audited on 2021/03/31

Auditor

59 audits on Trustblock

Multi-Tags

Issues (8)

	Low	Medium	High	Critical	Total
Not fixed	-	-	-	-	0
Fixed	6	2	-	-	8
Total	6	2	0	0	8

Contracts (6)

#	File Name
1	governance/contracts/TreasuryVester.sol
2	governance/contracts/TokenDistributor.sol
3	governance/contracts/SafeMath.sol
4	governance/contracts/Timelock.sol
5	governance/contracts/GovernorAlpha.sol
6	governance/contracts/GTC.sol

Gitcoin Token Distribution

Summary

Issues (8)

ESMS use of sanitized user_amount & user_id valuesfixed/medium

Prefer using abi.encode in TokenDistributorfixed/medium

ESMS use of environment variable for chain info [Optimization]fixed/low

Improve efficiency by using immutable in TreasuryVesterfixed/low

Method returns bool but result is never used in TokenDistributor.claimTokensfixed/low

Contracts (6)