Quantstamp reviewed Reach (/Reach - Diff 1) on 15 Dec 2023: 20 findings, 0 critical; 15 marked fixed, 3 acknowledged, 2 open.
Report hosted on certificate.quantstamp.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 0 | 3 |
| Medium | 1 | 2 | 1 |
| Low | 0 | 1 | 11 |
The functions `setEthDistribution()` and `setReachDistribution()` accept two input arguments: the `_merkleRoot` containing all the users and the amount each user should get, and the `_amount` input representing the total amount to be distributed. The `_amount` value should be equal to the total amount to be distributed to all the leaves in the Merkle tree, and also less or equal to the current ETH or token balance of the contract. Otherwise, some users would be expecting rewards that are not even available.
Distributions are held in different rounds, where a user must submit their Merkle proof to claim their rewards for the current round. If the round has elapsed through calling `createDistribution()`, the Merkle roots are overwritten. Though the funds remain in the contract for a future distribution, there is no guarantee that the new Merkle roots will account for unclaimed prizes.
1. `ReachDistribution` - The owner can: - Pause and resume reward claiming. - Change the Merkle root of the current distribution at any time with `setEthDistribution()` and `setReachDistribution()`. See `Distributions Merkle Roots Can Be Overwritten`. - Create new distributions calling `createDistribution()`. - Change the address of `reachToken`. 2. `ReachFactory` - Owner can: - Change `prices`: the prices of the credits and the minimum ETH allocation. - Deploy new `ReachDistribution` contracts. - Sign data to allow users to call `topUp()` and `reserveEthAllocation()`. 3. `Reach` - Owner can: - Will receive all initial supply (`10e7` tokens). - Transfer out any ERC-20 tokens locked in the contract, including `REACH` fees captured from buy/sell tax. - Update router. - Exclude addresses from paying fees. - Mark addresses as AMM pairs (charge buy and sell tax). - Change buy and sell tax percentage (up to 20%). - Activate trading. - Set and change treasury and dev wallets. - Blacklist any address (bots). - Change the threshold to swap `REACH` fees to ETH.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (1)
236 projects reviewed · 332 reports · latest Oct 2026
See Quantstamp’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us