Mavia Token security record
As of 3 Nov 2026, Mavia Token has 1 audit report on Trustblock, by Quantstamp, dated 6 Nov 2023. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Mavia Token | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Findings9
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 3 | 0 |
| Low | 0 | 2 | 3 |
HighRegistered Gateways Can Transfer Mavia Tokens without ApprovalMavia Token · Quantstamp · 6 Nov 2023Fixed
Any address registered as a *gateway* can transfer Mavia tokens from **any** address, even when a Mavia token holder has not approved the gateway address. Additionally, due to the `fBurn()` function, a gateway address can burn tokens from any other address by transferring the tokens to themself and burning the tokens. According to the client, gateway addresses are used for their "pool/dapp/bridge". However, this implies the following trust assumptions for the user: 1. The user has to trust the admin only to set such applications as gateway addresses and no other addresses. 1. The user has to trust that these applications are secure and cannot misuse their privileged access. 1. The user has to trust that the admin acts honestly and the keys are not compromised.
Open the reportLowInconsistent Use of `_msgSender()` and `msg.sender`Mavia Token · Quantstamp · 6 Nov 2023Fixed
Throughout the contact, the message sender is obtained via `_msgSender()` and `msg.sender`. For consistency, get the caller's address using only `_msgSender()`.
Open the reportLowIndex Event Parameters for Improved Application MonitoringMavia Token · Quantstamp · 6 Nov 2023Fixed
Application monitoring can be improved by [indexing](https://docs.soliditylang.org/en/v0.8.4/cheatsheet.html#modifiers) specific parameters emitted in an event. By indexing event parameters, off-chain systems can more easily filter contract logs by the indexed data. The following event parameters could benefit from indexing: 1. `_pAddr` in the event `ESetBlacklist`. 2. `_pAddr` in the event `ESetWhitelist`. 3. `_pAddr` in the event `ESetGateway`. 4. `_pToken` in the event `EEmerERC20Tokens`.
Open the reportLowTruffle Suite Has Been SunsetMavia Token · Quantstamp · 6 Nov 2023Fixed
Truffle and Ganache have recently been [sunset](https://consensys.io/blog/consensys-announces-the-sunset-of-truffle-and-ganache-and-new-hardhat?utm_source=github&utm_medium=referral&utm_campaign=2023_Sep_truffle-sunset-2023_announcement_). Consider using tooling that will be continuously supported through the lifetime of Mavia token.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="mavia-token"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us