Subscription Token - Fabric

QuantstampRepository at commit 504dd06

Quantstamp reviewed Subscription Token Protocol V2 (Subscription Token - Fabric) on 25 Oct 2023: 9 findings, 0 critical; 5 marked fixed, 4 acknowledged.

No open critical findings
Open the reportOpen Subscription Token Protocol V2’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings9

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High001
Medium022
Low022
MediumPrivileged Roles and OwnershipAcknowledged

Smart contracts will often have `owner` variables to designate the person with special privileges to make modifications to the smart contract. `Owner` can: * set/update the transfer recipient * set/update the supply cap * pause/unpause the contract * grant time to any accounts * update contract metadata * refund remaining purchase time to any account * withdraw contract funds to any account * create/delete referral codes

MediumUsers Can Get Discounted SubscriptionAcknowledged

The function `mintWithReferralFor()` takes both the `referralCode` and the `referrer` as user input. This means the user is free to choose whatever value they would like for `referrer`, including their own address. Take the following scenario as an example: 1. Alice provides Bob with her referral code. 2. Bob purchases a subscription for himself, but instead of specifying Alice as the `referrer`, he specifies himself. 3. Bob gets a discount on his purchase, while Alice does not receive any payout.

LowCannot Transfer to Other Accounts with Expired SubscriptionsAcknowledged

The hook `_beforeTokenTransfer()` checks if the `to` address has a subscription, whether it is active or not. If that is the case, it prevents the transfer. This will prevent transferring to users who have expired subscriptions.

LowFee Recipient Cannot Be Added if Not Initially SetAcknowledged

To update the `_feeCollector`, the call to `updateFeeRecipient()` must come from the current `_feeCollector`. If the `_feeCollector` was not initially set to a non zero address during initialization, then the `_feeCollector` can't be updated from the duration of the contract's life cycle.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (8)

  • https://github.com/withfabricxyz/contracts/test/subscriptions/SubscriptionTokenV1Referral.t.sol at commit 504dd067171c0104c071fa379383af77e17e2d26
  • https://github.com/withfabricxyz/contracts/test/subscriptions/SubscriptionTokenV1Grants.sol at commit 504dd067171c0104c071fa379383af77e17e2d26
  • https://github.com/withfabricxyz/contracts/test/subscriptions/BaseTest.t.sol at commit 504dd067171c0104c071fa379383af77e17e2d26
  • https://github.com/withfabricxyz/contracts/src/subscriptions/SubscriptionTokenV1.sol at commit 504dd067171c0104c071fa379383af77e17e2d26
  • https://github.com/withfabricxyz/contracts/test/subscriptions/SubscriptionTokenV1Fee.t.sol at commit 504dd067171c0104c071fa379383af77e17e2d26
  • https://github.com/withfabricxyz/contracts/test/subscriptions/SubscriptionTokenV1Rewards.t.sol at commit 504dd067171c0104c071fa379383af77e17e2d26
  • https://github.com/withfabricxyz/contracts/test/subscriptions/SubscriptionTokenV1.t.sol at commit 504dd067171c0104c071fa379383af77e17e2d26
  • https://github.com/withfabricxyz/contracts/test/subscriptions/SubscriptionTokenV1Factory.t.sol at commit 504dd067171c0104c071fa379383af77e17e2d26

Part of Subscription Token Protocol V2’s security record

Subscription Token Protocol V2
Audits2 audits by 1 firmLast audit May 2024, by Quantstamp.
Critical findingsNo open critical findingsAcross 2 reports.
Open Subscription Token Protocol V2’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us