Chromia FT4 (token library)
Quantstamp reviewed Chromia (Chromia FT4 (token library)) on 21 Jun 2024: 10 findings, 0 critical; 8 marked fixed, 2 acknowledged.
Report hosted on certificate.quantstamp.com.
Trustblock does not review code.
Findings10
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 2 |
| Low | 0 | 2 | 6 |
LowNoteworthy Behavior Regarding Minting & BurningAcknowledged
While not an issue in and of itself, the FT4 library may have some default behaviors that will be unexpected for users/developers from other ecosystems. When integrating the library, developers should confirm whether this is the desired behavior for their dapp and make any necessary adjustments. Additionally, users should be aware of the possibility of these behaviors before interacting with a dapp. A non-exhaustive list of these behaviors includes: * `rell/src/lib/ft4/external/admin/operations::mint()`: The admin can mint any amount of an asset without restriction. * `rell/src/lib/ft4/external/assets/operations::burn()`: Unlike the ERC-20 standard in which burning is a custom extension, the FT4 library has burning enabled as a default. More specifically, a user can decide to burn their own assets.
LowThe `resolver()` Is Not Guaranteed to Return Rule-Abiding Auth DescriptorsAcknowledged
`get_first_allowed_auth_descriptor()` makes a call to `get_auth_handler(op_name).resolver()`. The resolver will go through the list of auth descriptors and return the first allowed one. However, there is no validation that the auth descriptor isn't violating any rules. This can result in valid auth descriptors being ignored.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (130)
- ft4/external/accounts/queries.rell
- utils.ts
- ft4/core/accounts/strategies/transfer/subscription/config.rell
- ft4/core/assets/extensions.rell
- web3-generic.ts
- browser-login-keystore.ts
- ft4/prioritization/default/module.rell
- ft4/core/accounts/strategies/transfer/queries.rell
- in-memory.ts
- ft4/external/crosschain/operations.rell
- ft4/core/accounts/strategies/transfer/open/module.rell
- type-predicates.ts
- ft4/core/prioritization/module.rell
- operations.ts
- ft4/core/assets/module.rell
- ft4/accounts/module.rell
- subscription.ts
- asset-query-functions.ts
- ft4/core/prioritization/default/module.rell
- main.ts
- asset-queries.ts
- ft4/assets/module.rell
- ft4/external/admin/module.rell
- transfer-history-queries.ts
- transaction-signer.ts
- web3-provider.ts
- ft4/external/assets/locking/module.rell
- admin-operations.ts
- enum-parsers.ts
- ft4/assets/locking/module.rell
- ft4/external/accounts/module.rell
- ft4/external/assets/module.rell
- transfer-history-query-functions.ts
- enum-parser.ts
- ft4/accounts/strategies/transfer/open/module.rell
- ft4/core/accounts/strategies/auth_message.rell
- ft4/external/assets/locking/queries.rell
- ft4/core/accounts/strategies/transfer/subscription/queries.rell
- ft4/core/accounts/auth_descriptor_rule_validation.rell
- ft4/accounts/strategies/transfer/fee/module.rell
- ft4/external/accounts/strategies/module.rell
- ft4/accounts/strategies/transfer/subscription/module.rell
- error.ts
- ft4/utils/pagination.rell
- ft4/external/admin/operations.rell
- errors.ts
- ft4/external/auth/operations.rell
- ft4/external/accounts/operations.rell
- types.ts
- orchestrator.ts
- ft4/utils/utils.rell
- operators.ts
- ft4/external/crosschain/queries.rell
- emitter.ts
- ft4/core/accounts/strategies/transfer/subscription/module.rell
- exposed-operations.ts
- ft4/prioritization/module.rell
- gtv.ts
- ft4/external/accounts/strategies/operations.rell
- handlers.ts
- open.ts
- ft4/crosschain/module.rell
- index.ts
- ft4/external/crosschain/module.rell
- ft4/core/accounts/strategies/transfer/module.rell
- ft4/core/crosschain/module.rell
- ft4/core/accounts/auth_external.rell
- admin-op-functions.ts
- local-storage.ts
- ft4/test/utils.rell
- transfer-history-entry.ts
- ft4/module.rell
- transaction-builder.ts
- ft4/core/admin/module.rell
- ft4/accounts/strategies/module.rell
- transfer.ts
- ft4/core/assets/locking/module.rell
- ft4/core/accounts/auth_flags_config.rell
- ft4/auth/module.rell
- ft4/core/auth/module.rell
- pathfinder.ts
- directory-chain.ts
- ft4/external/auth/module.rell
- ft4/accounts/linking/module.rell
- ft4/core/accounts/rate_limit.rell
- queries.ts
- ft4/core/accounts/strategies/transfer/fee/config.rell
- ft4/admin/crosschain/module.rell
- ft4/external/accounts/strategies/queries.rell
- ft4/external/assets/queries.rell
- ft4/core/crosschain/blockchain.rell
- auth-descriptor.ts
- ft4/core/accounts/strategies/module.rell
- ft4/core/accounts/strategies/transfer/fee_config.rell
- op-functions.ts
- ft4/core/accounts/strategies/transfer/config_utils.rell
- ft4/core/accounts/strategies/transfer/fee/queries.rell
- ft4/core/accounts/linking/model.rell
- ft4/core/auth/authentication.rell
- ft4/core/accounts/module.rell
- ft4/core/auth/login.rell
- ft4/accounts/strategies/open/module.rell
- ft4/core/crosschain/extensions.rell
- ft4/core/accounts/strategies/transfer/fee/module.rell
- variables.ts
- ft4/core/accounts/auth_descriptor_rule_expression.rell
- ftEventEmitter.ts
- key-handler.ts
- ft4/core/assets/asset.rell
- ft4/accounts/strategies/transfer/module.rell
- ft4/external/auth/queries.rell
- query-functions.ts
- ft4/external/assets/operations.rell
- in-memory-keystore.ts
- ft4/admin/module.rell
- ft4/external/admin/crosschain/module.rell
- session-storage.ts
- ft4/core/assets/locking/functions.rell
- entity-retriever.ts
- ft4/core/accounts/strategies/transfer/config.rell
- ft4/core/crosschain/transfer.rell
- ft4/core/assets/transfer.rell
- ft4/core/accounts/strategies/open/module.rell
- fee.ts
- ft4/core/accounts/linking/module.rell
- amount.ts
- ft4/core/assets/history.rell
- ft4/core/accounts/auth_basic.rell
- evaluation.ts
- ft4/version.rell
Part of Chromia’s security record
ChromiaSecurity firm
Quantstamp236 projects reviewed · 332 reports · latest Oct 2026
See Quantstamp’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us