Mainframe security record
As of 3 Nov 2026, Mainframe has 2 audit reports by 1 security firm on Trustblock; the latest is by Quantstamp, dated 9 Nov 2020. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Audits2
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Mainframe | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
| Mainframe Secondary Audit | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Findings12
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 3 | 7 | 2 |
LowAssumed Constant Number of DecimalsMainframe · Quantstamp · 9 Nov 2020Acknowledged
It is important to state explicitly that `FyToken` expects the underlying and collateral to have a constant values of `decimals()`. It's a reasonable assumption, but there may exist tokens that have a variable value of `decimals()`.
Open the reportLowClone-and-OwnMainframe · Quantstamp · 9 Nov 2020Acknowledged
The clone-and-own approach involves copying and adjusting open source code at one's own discretion. From the development perspective, it is initially beneficial as it reduces the amount of effort. However, from the security perspective, it involves some risks as the code may not follow the best practices, may contain a security vulnerability, or may include intentionally or unintentionally modified upstream libraries. Several files, particularly libraries, are cloned for this project.
Open the reportLowPossible Malicious Interactions With Other ContractsMainframe · Quantstamp · 9 Nov 2020Acknowledged
Malicious interactions with other protocols like Uniswap may be possible. For example, the contract may be susceptible to flash loans.
Open the reportLowPotential Misuse of `decimals`Mainframe · Quantstamp · 9 Nov 2020Acknowledged
Lines 60, 67: although `decimals()` usually returns the correct expected value, according to the ERC20 spec "This method can be used to improve usability, but interfaces and other contracts MUST NOT expect these values to be present" From [EIPs/eip-20.md at master · ethereum/EIPs](https://github.com/ethereum/EIPs/blob/master/EIPS/eip-20.md).
Open the reportLowPrivileged Roles and OwnershipMainframe · Quantstamp · 9 Nov 2020Acknowledged
Smart contracts will often have `owner` variables to designate the person with special privileges to make modifications to the smart contract. However, this centralization of power needs to be made clear to the users, especially depending on the level of privilege the contract allows to the owner.
Open the reportLowRace Conditions / Front-RunningMainframe · Quantstamp · 9 Nov 2020Acknowledged
A block is an ordered collection of transactions from all around the network. It's possible for the ordering of these transactions to manipulate the end result of a block. A miner attacker can take advantage of this by generating and moving transactions in a way that benefits themselves. Specifically, if an account can be liquidated, only the first mined transaction(s) to deplete the total debt will succeed.
Open the reportLowUnlocked PragmaMainframe · Quantstamp · 9 Nov 2020Acknowledged
Every Solidity file specifies in the header a version number of the format `pragma solidity (^)0.4.*`. The caret (`^`) before the version number implies an unlocked pragma, meaning that the compiler will use the specified version _and above_, hence the term "unlocked".
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="mainframe-1"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us