qiibee foundation $QBX security record
As of 28 Oct 2026, qiibee foundation $QBX has 3 audit reports by 1 security firm on Trustblock; the latest is by CertiK, dated 26 Feb 2025. Those reports list 1 open critical finding.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits3
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| qiibee - Staking | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| qiibee - Token Sale | Security firm: CertiK | Date: | Scope: Files named in the report | 1 open critical finding | Open · skynet.certik.com |
| QBX Token | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
Findings11
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 1 | 0 | 0 |
| High | 0 | 2 | 0 |
| Medium | 0 | 0 | 1 |
| Low | 1 | 1 | 5 |
CriticalMisleading Function Name and Functionality in `seqiibee - Token Sale · CertiK · 10 Sep 2024Open
The `setWinners` function in the `Raffle` contract appears to perform actions that do not align with its name. Instead of setting or recording winners, the function transfers the specified amounts from each winner's balance to the contract owner, which is misleading and can lead to confusion or misuse. ```solidity function setWinners( address[] calldata winners, uint256[] calldata amountList ) external onlyOwner returns (uint256) { require(uint64(block.timestamp) > endTime, "Raffle is still open"); require( winners.length == amountList.length, "Array lengths should match" ); uint256 amountToWithdraw = 0; for (uint16 i = 0; i < winners.length; i++) { amountToWithdraw += amountList[i]; // debit user's amount amounts[winners[i]] -= amountList[i]; } payable(owner()).transfer(amountToWithdraw); return amountToWithdraw; } ```
Open the reportLowUsage of `transfer`/`send` for Sending Native Tokqiibee - Token Sale · CertiK · 10 Sep 2024Open
It is not recommended to use Solidity's `transfer()` and `send()` functions for transferring native tokens, since some contracts may not be able to receive the funds. Those functions forward only a fixed amount of gas (2300 specifically) and the receiving contracts may run out of gas before finishing the transfer. Also, EVM instructions' gas costs may increase in the future. Thus, some contracts that can receive now may stop working in the future due to the gas limitation. ```solidity=77 payable(owner()).transfer(amountToWithdraw); ``` - `Raffle.setWinners` uses `transfer()`.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="qiibee"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us