As of 3 Nov 2026, Mabrook PRE ICO has 1 audit report on Trustblock, by QuillAudits, dated 15 Jan 2024. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| AL Mabrook Financials Inc | Security firm: QuillAudits | Date: | Scope: Files named in the report | No open critical findings | Open · quillaudits.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 2 |
| Medium | 0 | 0 | 1 |
| Low | 2 | 0 | 3 |
The Token contract inherits IToken, AgentRoleUpgradeable, and the TokenStorage. When the init function is invoked, all of the state variables would be updated and also the state variables in the inherited contract. In this case, where the Ownable_init() function from the OwnableUpgradeable is not invoked in the init function from the Token contract, the _owner address would be address zero since it was never invoked and it is impossible to invoke afterwards since the OwnableUpgradeable is an abstract contract. This function could have identified the issue if it has employed critical input sanitization to ensure that these addresses are not null addresses.
Open the reportThese are two critical functions to the protocol that allows for the protocol owners to create new instances of the Escrow and Almabrook contracts. However, these functions do not have a modifier restriction to allow only privileged addresses to invoke. This implies that malicious users can create multiple Escrow and Almabrook contracts for malicious purposes.
Open the reportThe creation of Almabrook contract clone is done with the launch function. This function checks some key properties that make up the Almabrook contract. While the first check appropriately ensures that _startAt can either be equal to the block.timestamp or greater, this implies that the Almabrook activities should begin immediately after launch or after a period of time set in the future. However, the second check ensures that _endAt time can be equal to the _startAt or greater than. This is where the vulnerability arises. If at any point in time, _endAt == _startAt, the project ends after one second.
Open the reportThe cancel function has an onlyOwner modifier that checks that creator == msg.sender. After this check, this check was again checked for the second time. The gas cost for calling this function will charge double for this check and invariably increase gas fee.
Open the reportThe getBalance function is a function in Almabrook declared as public to get the balance of an address. However, this function was not invoked within the contract. In order to save gas invoking this function, it is recommended to mark this function as external.
Open the reportThe escrowId is a state variable that tracks all of the created escrows. However, this state variable gets updated every time an escrow is deployed and gets set as the id for an individual escrow.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="mabrook-pre-ico"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us