Kinto Token & Vesting

Pessimistic19 Mar 20241 address on Ethereum

Audit

Pessimistic reviewed Kinto (Kinto Token & Vesting) on 19 Mar 2024: 6 findings, 0 critical; all marked fixed.

No open critical findings

Open the report Open Kinto’s security record

Report hosted on GitHub.

Trustblock does not review code.

Findings6

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	0	0	3
Low	0	0	3

MediumInaccurate timestampFixed

The GOVERNANCE_RELEASE_DEADLINE constant from the KintoToken contract is inaccurately assigned to 1714489, which corresponds to January 20, 1970.

MediumLack of transfer allowanceFixed

Before the governance deployment, token transfers between the users are supposed to be disabled. However, there are specific accounts that should be able to receive and transfer the tokens.

MediumProject rolesFixed

In the current implementation, the system depends heavily on the owner's role. Thus, there are scenarios that can lead to undesirable consequences for the project and its users, e.g., if the owner's private keys become compromised. We recommend designing contracts in a trustless manner or implementing proper key management, e.g., setting up a multisig. Comment from the developers: The contract is owned by our Gnosis Safe Multisig with 3 of 5 signers and all those privileged roles will be handed out to on-chain governance as soon as Governance is released at the end of May.

LowIntrinsic gas optimizationFixed

The report gives no description here.

LowMissing events for critical parameters changeFixed

The report gives no description here.

LowRedundant checkFixed

The report gives no description here.