FireStarter security record

Polygon (POS)firestarter.fi

As of 2 Nov 2026, FireStarter has 1 audit report on Trustblock, by Quantstamp, dated 11 Sep 2021. That report lists no open critical findings.

Critical findings
No open critical findings
In 1 report.
Open the latest report
Your label, live
Get the label for your site

Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.

Audits1

Newest first

AuditSecurity firmDateScopeCritical findingsReport
FirestarterSecurity firm: QuantstampDate: Scope: Files named in the reportNo open critical findingsOpen · certificate.quantstamp.com

Findings23

Statuses are the security firm’s own, from each report.

SeverityOpenAcknowledgedFixed
Critical000
High003
Medium004
Low1015
LowMissing input validationFirestarter · Quantstamp · 11 Sep 2021Open

It is important to validate inputs, even if they only come from trusted addresses, to avoid human error. The following functions do not have a proper validation of input parameters: 1. `Vesting.init()` does not check if the `presale` parameter is different from `address(0)`. 2. `Vesting.initialize()` does not check if the `_rewardToken` parameter is different from `address(0)`. This function does not check if the `_param` parameter attributes are in the permitted ranges, e.g. `_params.initialUnlock > block.timestamp`. 3. `TokenLock.initialize()` does not check if the `_token` parameter is different from `address(0)`. 4. `Presale.initialize()` does not check if the `AddressParams` are different from `address(0)`. Note that if the `projectOwner` would be `address(0)` by mistake, the `withdrawFunds()` and `withdrawUnsoldToken()` functions would no longer work. 5. `Presale.initialize()` does not check if the `PresaleParams` are greater than `0` and most importantly that `_presale.startTime > block.timestamp`. 6. `Staking.initialize()` does not validate that the `_lpToken` and `_flame` input parameters are different than `address(0)`. This function does not check if the `_startTime > block.timestamp` and `_earlyWithdrawal` is not checked to be shorter than `stakingPeriod`

Open the report

Contracts

No deployed address is recorded for these audits.

The reports name a repository or files. Open a report to see its scope.

The repositories and files the reports name

Show this on your site

Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.

Content

Facts

Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.

Fixed as
Language

Style

Layout
Theme
Accent
Corners

Format

Size
Date
Embed as
HTML
<head>
<script src="https://widget.trustblock.run/project-widget.min.js" defer></script>
</head>
<body>
<div
data-tb-project-widget
data-tb-project-slug="firestarter"
></div>
</body>

Paste the code where the label should appear. It uses no API credit and updates by itself.

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us