Linkswap
Quantstamp reviewed Linkswap on 3 Nov 2020: 10 findings, 0 critical; 7 marked fixed, 3 acknowledged.
Report hosted on certificate.quantstamp.com.
Trustblock does not review code.
Findings10
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 3 | 6 |
MediumArbitrary token burningFixed
The function `burn` has no access restriction. Anyone can use this function to burn all the balance holds by this contract.
Low`SAME_VOTE` check in `vote` function has false positivesFixed
On L165: `require(support != (proposal.forVotes[msg.sender] > 0), "yYFL: SAME_VOTE");`, the conditional may incorrectly report a "same vote" when the vote has changed. Consider the following scenario: 1. A user has 10 YFL tokens that they use to vote for Proposal A, locking all 10 tokens; 2. The user gains 10 more tokens, and votes on Proposal B with all 20 tokens, also increasing their lock to 20. 3. The user wishes to increase their vote to 20 tokens for Proposal A. Both checks on L164-165 will succeed, triggering the revert.
LowMissing access control on `purchaseYfl`Fixed
The function is `external`, however all tokens transferred to this contract and then used to purchase YFL are sent to the governance contract, not the original `msg.sender`.
LowOracle can never miss an interval, else the `consult` function will experience outagesFixed
The function `getFirstObservationInWindow` returns the observation from the oldest epoch, which is set when `update` is invoked earlier in the `window`. However, if for any reason an epoch is missed by the oracle (e.g., via server outages, congested network, etc.), the epoch will continue to have stale data. If `consult` is invoked when this stale data is returned by `getFirstObservationInWindow`, the function will revert for the entire current epoch. Note that this effects upstream functions including `calculateTokenAmountFromUsdAmount`.
LowUnclear functionality in `purchaseYfl`Fixed
The function accepts a list of tokens, however conversions are only made between the pairs `(LINK, WETH)` and `(WETH, YFL)` Any other tokens are simply sent back to the governance address. Since the function is not documented, it is unclear what the intended semantics should be.
LowUnlocked PragmaFixed
Every Solidity file specifies in the header a version number of the format `pragma solidity (^)0.4.*`. The caret (`^`) before the version number implies an unlocked pragma, meaning that the compiler will use the specified version _and above_, hence the term "unlocked".
LowUnsafe External Call in `function purchaseYfl`Fixed
An attacker can execute arbitrary code by providing a fake token address to the function `purchaseYfl`.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (42)
- contracts/test/ChainlinkOracleTest.sol
- contracts/interfaces/ILinkswapRouter.sol
- contracts/YFLink.sol
- contracts/libraries/Math.sol
- contracts/test/RouterEventEmitterTest.sol
- contracts/YFLPurchaser.sol
- contracts/test/BabylonianTest.sol
- contracts/libraries/UQ112x112.sol
- contracts/interfaces/ILinkswapCallee.sol
- contracts/test/AddressStringUtilTest.sol
- contracts/interfaces/IYFLPurchaser.sol
- contracts/libraries/SafeERC20Namer.sol
- contracts/test/FixedPointTest.sol
- contracts/test/LinkswapPriceOracleTest.sol
- contracts/interfaces/IUniswapV2Pair.sol
- contracts/interfaces/ILinkswapPriceOracle.sol
- contracts/libraries/LinkswapLibrary.sol
- contracts/test/WETHTest.sol
- contracts/interfaces/IController.sol
- contracts/test/LinkswapERC20Test.sol
- contracts/libraries/TransferHelper.sol
- contracts/libraries/SafeMathLinkswap.sol
- contracts/libraries/PairNamer.sol
- contracts/test/TransferHelperTest.sol
- contracts/test/PairNamerTest.sol
- contracts/interfaces/IWETH.sol
- contracts/interfaces/IyYFL.sol
- contracts/interfaces/IChainlinkOracle.sol
- contracts/test/YFLPurchaserTest.sol
- contracts/LinkswapRouter.sol
- contracts/interfaces/ILinkswapPair.sol
- contracts/libraries/FixedPoint.sol
- contracts/test/ERC20Test.sol
- contracts/interfaces/ILinkswapFactory.sol
- contracts/test/DeflatingLinkswapERC20Test.sol
- contracts/interfaces/ILinkswapERC20.sol
- contracts/LinkswapPriceOracle.sol
- contracts/LinkswapPair.sol
- contracts/test/SafeERC20NamerTest.sol
- contracts/LinkswapFactory.sol
- contracts/libraries/AddressStringUtil.sol
- contracts/yYFL.sol
Part of Linkswap’s security record
Security firm
Quantstamp236 projects reviewed · 332 reports · latest Oct 2026
See Quantstamp’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us