As of 3 Nov 2026, Quantelica has 2 audit reports by 1 security firm on Trustblock; the latest is by QuillAudits, dated 28 Mar 2024. Those reports list no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Quantalica - Lite version | Security firm: QuillAudits | Date: | Scope: Files named in the report | No open critical findings | Open · quillaudits.com |
| Quantelica | Security firm: QuillAudits | Date: | Scope: Files named in the report | No open critical findings | Open · quillaudits.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 3 |
| Medium | 0 | 0 | 2 |
| Low | 0 | 0 | 9 |
The contract has a critical logic flaw in the removeSubcollection function, where tokens from other subcollections can be mistakenly burned. The iteration over token IDs for removal does consider that token IDs are the startIndex and endIndex of a subCollection but that’s not the case for any subcollection. As a result, this could lead to the unintended burning of NFTs that do not belong to the subcollection being removed, causing a severe impact on token ownership and integrity of the protocol.
Open the reportThe fulfillRandomWords function lacks proper access control, allowing any external entity to call this internal function. As a result, there is a critical security vulnerability where an unauthorized entity could potentially spoof a VRF response with arbitrary random values. It is crucial to restrict the invocation of this function to only trusted entities, specifically the VRFConsumerBase.rawFulfillRandomness method, to ensure the integrity of the VRF process.
Open the reportThe contract exhibits a potential security risk due to a missing check for whether the destination address (to) is blacklisted or not in the batchTransfer and mintGoldenToken function. Without proper validation, blacklisted addresses can potentially receive tokens through batch transfers, leading to a bypass of the blacklist mechanism. This oversight poses a security vulnerability, as it allows tokens to be transferred to blacklisted addresses, contrary to the intended restrictions.
Open the reportThe contract has an issue where the burn function attempts to delete a tokenCID, but the corresponding set function _setTokenCID is marked as private and cannot be directly called by the burn function. As a result, there is no mechanism in place to set or update the tokenCID, making it impossible to delete the CID within the burn function. This limitation hinders the contract's functionality and could lead to undesired consequences.
Open the reportThe contract has a high-severity issue in the burn function where it fails to check whether the specified token exists or not before attempting to burn it. This absence of a pre-check on token existence creates a critical vulnerability, as attempting to burn a nonexistent token could lead to unexpected behavior, compromising the integrity of the contract and causing potential disruptions in token ownership.
Open the reportLM Internal Functions(except isValidDepositAmount() function) in LoanManager.sol are never called from within contracts but yet declared public. Their visibility can be made external to save gas.
Open the reportSeveral functions within the contract lack necessary checks and verifications, potentially leading to unintended behaviours or vulnerabilities. These missing checks can impact the contract's security, correctness, and adherence to intended rules. It's crucial to incorporate these checks to ensure proper functionality and prevent unauthorized or erroneous actions.
Open the reportCustom errors reduce the contract size and can provide easier integration with a protocol. Consider using those instead of require statements with string error.
Open the reportIn the case of stable coins, the hierarchy of authority plays a crucial role and our team recommends that the roles with privileges must be given to the accounts with proven authority and functions like “Minting” and “Burning” must be used cautiously because once these functions are called on the mainnet then could be no minting or burning. Hence, it will be an irreversible change.
Open the reportSeveral critical functions within the contract lack validation checks to ensure that zero addresses are not accepted as input parameters. This oversight can lead to unintended behavior, security vulnerabilities, and potential exploitation if malicious actors pass zero addresses as arguments to these functions.
Open the reportCritical functions within the contract lack the emission of events. Events play a vital role in providing transparency, enabling external systems to react to changes, and offering a way to track important contract activities. The absence of events can hinder monitoring and auditing efforts, making it difficult to detect and respond to critical contract actions.
Open the reportContracts should be deployed with the same compiler version and flags that they have been tested with thoroughly. Locking the pragma helps to ensure that contracts do not accidentally get deployed using, for example, an outdated compiler version that might introduce bugs that affect the contract system negatively.
Open the reportThe contract contains sections of code that are defined but not referenced or executed during the contract's operation. This unused code might include functions, variables, or entire code blocks that serve no functional purpose or are not part of the contract's intended behavior. Unused code can increase the contract's complexity, potentially introducing confusion for developers and auditors and leading to unnecessary gas consumption.
Open the reportAffected versions of this package are vulnerable to Improper Input Validation.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="quantelica"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us