Origami (Governance & Membership tokens)

QuantstampFiles named in the report

Quantstamp reviewed Origami (Governance & Membership tokens) on 29 Jun 2022: 5 findings, 0 critical; 4 marked fixed, 1 acknowledged.

No open critical findings
Open the reportOpen Origami (Governance & Membership tokens)’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings5

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium000
Low014
LowApplication Monitoring Can Be Improved by Emitting More EventsFixed

In order to validate the proper deployment and initialization of the contracts, it is a good practice to emit events. Also, any important state transition can be logged, which is beneficial for monitoring the contract, and also tracking eventual bugs, or hacks. Below we present a non-exhaustive list of events that could be emitted to improve the application management: 1. `OrigamiGovernanceToken.enableBurn()` does not emit events reflecting changes made to state variable `_burnEnabled`. 1. `OrigamiGovernanceToken.disableBurn()` does not emit events reflecting changes made to state variable `_burnEnabled`. 1. `OrigamiGovernanceToken.enableTransfer()` does not emit events reflecting changes made to state variable `_transferEnabled`. 1. `OrigamiGovernanceToken.disableTransfer()` does not emit events reflecting changes made to state variable `_transferEnabled`. 1. `OrigamiGovernanceTokenFactory.createOrigamiGovernanceToken()` does not emit events reflecting changes made to state variable `proxiedContracts`. 1. `OrigamiMembershipToken.setBaseURI()` does not emit events reflecting changes made to state variable `_metadataBaseURI`. 1. `OrigamiMembershipToken.enableTransfer()` does not emit events reflecting changes made to state variable `_transferEnabled`. 1. `OrigamiMembershipToken.disableTransfer()` does not emit events reflecting changes made to state variable `_transferEnabled`. 1. `OrigamiMembershipTokenFactory.createOrigamiMembershipToken()` does not emit events reflecting changes made to state variable `proxiedContracts`.

LowBlock Timestamp ManipulationFixed

Projects may rely on block timestamps for various purposes. However, it's important to realize that miners individually set the timestamp of a block, and attackers may be able to manipulate timestamps for their own purposes to up to 900 seconds. If a smart contract relies on a timestamp, it must take this into account.

LowMissing Input ValidationFixed

It is important to validate inputs, even if they only come from trusted addresses, to avoid human error. Specifically, in the following functions arguments of type `address` may be initialized with value `0x0`: 1. `OrigamiGovernanceToken.initialize()` 1. `OrigamiMembershipToken.initialize()`

LowUnlocked PragmaFixed

Every Solidity file specifies in the header a version number of the format `pragma solidity (^)0.8.*`. The caret (`^`) before the version number implies an unlocked pragma, meaning that the compiler will use the specified version _and above_, hence the term "unlocked".

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (4)

  • contracts/OrigamiMembershipToken.sol
  • contracts/OrigamiGovernanceTokenFactory.sol
  • contracts/OrigamiGovernanceToken.sol
  • contracts/OrigamiMembershipTokenFactory.sol

Part of Origami (Governance & Membership tokens)’s security record

Origami (Governance & Membership tokens)
Audits1 audit by 1 firmLast audit Jun 2022, by Quantstamp.
Critical findingsNo open critical findingsIn 1 report.
Open Origami (Governance & Membership tokens)’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us