Hashflow Hashverse

Quantstamp22 Mar 2023Files named in the report

Quantstamp reviewed Hashflow (Hashflow Hashverse) on 22 Mar 2023: 20 findings, 0 critical; 16 marked fixed, 3 acknowledged, 1 open.

No open critical findings

Open the report Open Hashflow’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings20

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	1
Medium	0	0	1
Low	1	3	14

LowPrivileged Roles and OwnershipOpen

Smart contracts will often have `owner` variables to designate the person with special privileges to make modifications to the smart contract. In the case where a malicious actor obtains control of the owner's wallet, privileged functionality can be exploited in a way that harms future users. Specifically, a malicious actor could call `updateHashflowRouter()` in `RenovaCommandDeck` or `RenovaCommandDeckSatellite` to change the router address to a malicious contract. After the router is updated, users that call `RenovaQuest.trade()` are subject to having their funds stolen by the malicious router contract. The following are all other cases of owner privileges: - `RenovaCommandDeck.uploadItemMerkleRoot()` - `RenovaCommandDeck.mintItemAdmin()` - `RenovaCommandDeckBase.createQuest()` - `RenovaCommandDeckBase.updateRenovaAvatar()` - `RenovaCommandDeckBase.updateRenovaItem()` - `RenovaAvatarBase.refreshMetadata()` - `RenovaAvatarBase.refreshAllMetadata()` - `RenovaItem.updateMinterAuthorization()` - `RenovaItem.mint()` - `RenovaItemBase.setDefaultRoyalty()` - `RenovaItemBase.setCustomBaseURI()` - `RenovaItemBase.refreshMetadata()` - `RenovaItemBase.refreshAllMetadata()` - `WormholeBaseUpgradeable.updateWormhole()` - `WormholeBaseUpgradeable.updateWormholeConsistencyLevel()` - `WormholeBaseUpgradeable.updateWormholeRemote()`