Vaulty

QuillAudits12 Apr 2023Files named in the report

Audit · firm’s term: audit report

QuillAudits reviewed Vaulty - Goal vault and Time Vault (Vaulty) on 12 Apr 2023: 6 findings, 0 critical; none marked fixed.

No open critical findings

Open the report Open Vaulty - Goal vault and Time Vault’s security record

Report hosted on quillaudits.com.

Trustblock does not review code.

Findings6

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	2	0	0
Medium	2	0	0
Low	2	0	0

HighUnhandled custom ERC20 tokensOpen

Custom ERC20 tokens could be used to interact with the vault if whitelisted by the vault owner. These custom tokens could affect the internal accounting of the vault. A key example would be ‘Fee on Transfer’ tokens which can deduct a portion of tokens before or after transfers happen. The vault checks for how much was sent in the deposit() function call but not how much the contract holds and this can be problematic when fees are deducted.

HighZero fee deposits: POCOpen

The protocol generates revenue by collecting fees on deposits to vaults. The deposit fee can be set by the owner at any time, but if not set, depositFee will be 0. This should be a bug unless otherwise required to be a zero-fee vault at some times.

MediumMissing test casesOpen

The codebase lacks unit test coverage. It is advisable to have test coverage greater than 95% of the codebase to reduce unexpected functionality and help fuzz test as many invariants as possible.

MediumPrivileged account transfersOpen

If renouncing ownership is not done appropriately, the current contract owner can renounce ownership, lose owner privileges, and lose access to the tokens sent to the contract forever. When ownership is renounced, functions like withdrawFees() will be uncallable and any fees generated from deposits will be inaccessible.

LowEvent emissionOpen

Some of the contract functions that update the vault’s state do not emit events when called. It is advisable for ease of tracking changes on the blockchain to emit events. The following functions could have events emitted when called

LowUnlocked pragmaOpen

The solidity pragma version in this codebase is unlocked.