PerlinXerc20emission

Quantstamp10 Aug 2020Files named in the report

Quantstamp reviewed PerlinX (PerlinXerc20emission) on 10 Aug 2020: 9 findings, 0 critical; 3 marked fixed, 6 acknowledged.

No open critical findings

Open the report Open PerlinX’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings9

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	0	0
High	0	0
Medium	0	0
Low	6	3

LowBusiness logic contradicts the codeFixed

The `.div(baseline)` on `L234` contradicts the comment about `1bn` on `L233`, since `ERC20(perlin1).totalSupply()` is a variable instead of a constant.

LowContract is subject to race conditionsFixed

Due to mining non-deterministic order, `changeEmissionCurve`, `changeEraDuration`, `changeIncentiveAddress` may lead to transaction order dependency situations. ** 2020-08-18 update **: Perlin team added a safety check to the function `changeEraTime()`. For the two other functions, Perlin team stated that the likelihood of this attack is rather small due to: "1) Emissions are only paid (intended) once a day, the likelihood that DAO will adjust params on the same block as the emissions is extremely low and 2) The worse case is the DAO transaction reverts, or the emission transaction reverts" and hence suggested not to modify their code.

LowInteger Overflow / UnderflowFixed

`SafeMath` is not used on `L223`, `L224`.