StakeHound

Quantstamp7 Oct 2020Files named in the report

Quantstamp reviewed StakeHound on 7 Oct 2020: 8 findings, 0 critical; 3 marked fixed, 4 acknowledged, 1 open.

No open critical findings

Open the report Open StakeHound’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings8

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	0	0	0
Low	1	4	3

LowExecute TransactionsFixed

`DownstreamCaller.executeTransactions` is a public function. Depending on the listed transactions, allowing it to be called by a non-owner or by any other address than `StakedToken` can be a risk. No specifications were provided to correctly estimate the impact of this issue.

LowToken BurningFixed

Only the supply controller is allowed to burn tokens through `StakedToken.burn`, however, `msg.sender` is used to set the `account` from where the tokens are burned. We cannot determine if this is an error or part of the design, the code documentation does not specify the addresses allowed to use the described functionality.

LowUnlocked PragmaFixed

Every Solidity file specifies in the header a version number of the format `pragma solidity (^)0.6.*`. The caret (`^`) before the version number implies an unlocked pragma, meaning that the compiler will use the specified version _and above_, hence the term "unlocked."