Quantstamp reviewed Subscription Token Protocol V2 (Subscription Token - Fabric) on 25 Oct 2023: 9 findings, 0 critical; 5 marked fixed, 4 acknowledged.
Report hosted on certificate.quantstamp.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 2 | 2 |
| Low | 0 | 2 | 2 |
Smart contracts will often have `owner` variables to designate the person with special privileges to make modifications to the smart contract. `Owner` can: * set/update the transfer recipient * set/update the supply cap * pause/unpause the contract * grant time to any accounts * update contract metadata * refund remaining purchase time to any account * withdraw contract funds to any account * create/delete referral codes
The function `mintWithReferralFor()` takes both the `referralCode` and the `referrer` as user input. This means the user is free to choose whatever value they would like for `referrer`, including their own address. Take the following scenario as an example: 1. Alice provides Bob with her referral code. 2. Bob purchases a subscription for himself, but instead of specifying Alice as the `referrer`, he specifies himself. 3. Bob gets a discount on his purchase, while Alice does not receive any payout.
The hook `_beforeTokenTransfer()` checks if the `to` address has a subscription, whether it is active or not. If that is the case, it prevents the transfer. This will prevent transferring to users who have expired subscriptions.
To update the `_feeCollector`, the call to `updateFeeRecipient()` must come from the current `_feeCollector`. If the `_feeCollector` was not initially set to a non zero address during initialization, then the `_feeCollector` can't be updated from the duration of the contract's life cycle.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (8)
236 projects reviewed · 332 reports · latest Oct 2026
See Quantstamp’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us