Mangachain

QuillAudits18 Nov 2024Files named in the report

Audit · firm’s term: audit report

QuillAudits reviewed Mangachain on 18 Nov 2024: 6 findings, 0 critical; all marked fixed.

No open critical findings

Open the report Open Mangachain’s security record

Report hosted on quillaudits.com.

Trustblock does not review code.

Findings6

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	0	0	1
Low	0	0	5

MediumAnyone in the whitelist is able to call withdrawFixed

The withdraw() function intents to withdraw funds for first five owners.However, isOwners modifier allows all 10 of them to call. This is not the expected behavior since it allows anyone apart from first five owner to call withdraw

Low_updateOwnerInfos should have an added safety checkFixed

The _updateOwnerInfos function assumes that the newOwnerInfos array contains exactly 10 elements, but this is not enforced with a require statement. This can lead to unintended behavior if an incorrect array length is passed during deployment.

LowLack of error message in modifierFixed

The onlyDeployer modifier doesn't include an error message, leading to a default "revert" without clarity.

LowRedundant fallback functionFixed

Both fallback and receive functions are present but don't implement distinct behaviors, making one redundant.

LowRedundant State VariableFixed

If the whitelist functionality is hardcoded and there's no intention to use Merkle trees, remove silverMerkleRoot and goldMerkleRoot to simplify the contract. This will save gas cost by removing state variables

LowRedundant Whitelist EntryFixed

The _setupWhiteLists function has duplicate entries for some addresses (e.g., 0xAb8483F64d9C6d1EcF9b849Ae677dD3315835cb2 and 0x4B20993Bc481177ec7E8f571ceCaE8A9e22C02db .