/Reach - Diff 1

QuantstampRepository at commit e7306b8

Quantstamp reviewed Reach (/Reach - Diff 1) on 15 Dec 2023: 20 findings, 0 critical; 15 marked fixed, 3 acknowledged, 2 open.

No open critical findings
Open the reportOpen Reach’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings20

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High103
Medium121
Low0111
MediumBalance Is Not Guaranteed to Cover All Users RewardsAcknowledged

The functions `setEthDistribution()` and `setReachDistribution()` accept two input arguments: the `_merkleRoot` containing all the users and the amount each user should get, and the `_amount` input representing the total amount to be distributed. The `_amount` value should be equal to the total amount to be distributed to all the leaves in the Merkle tree, and also less or equal to the current ETH or token balance of the contract. Otherwise, some users would be expecting rewards that are not even available.

MediumUsers Cannot Claim Rewards From Old VersionsAcknowledged

Distributions are held in different rounds, where a user must submit their Merkle proof to claim their rewards for the current round. If the round has elapsed through calling `createDistribution()`, the Merkle roots are overwritten. Though the funds remain in the contract for a future distribution, there is no guarantee that the new Merkle roots will account for unclaimed prizes.

LowPrivileged RolesAcknowledged

1. `ReachDistribution` - The owner can: - Pause and resume reward claiming. - Change the Merkle root of the current distribution at any time with `setEthDistribution()` and `setReachDistribution()`. See `Distributions Merkle Roots Can Be Overwritten`. - Create new distributions calling `createDistribution()`. - Change the address of `reachToken`. 2. `ReachFactory` - Owner can: - Change `prices`: the prices of the credits and the minimum ETH allocation. - Deploy new `ReachDistribution` contracts. - Sign data to allow users to call `topUp()` and `reserveEthAllocation()`. 3. `Reach` - Owner can: - Will receive all initial supply (`10e7` tokens). - Transfer out any ERC-20 tokens locked in the contract, including `REACH` fees captured from buy/sell tax. - Update router. - Exclude addresses from paying fees. - Mark addresses as AMM pairs (charge buy and sell tax). - Change buy and sell tax percentage (up to 20%). - Activate trading. - Set and change treasury and dev wallets. - Blacklist any address (bots). - Change the threshold to swap `REACH` fees to ETH.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (1)

  • https://github.com/get-reach-dev/smart-contracts/contracts/ReachDistribution.sol at commit e7306b8

Part of Reach’s security record

Reach
Audits2 audits by 1 firmLast audit Jan 2024, by Quantstamp.
Critical findingsNo open critical findingsAcross 2 reports.
Open Reach’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us