Skip to content
$1,000,000 in security audit grants are live now, Apply here →
Get a quote

Security review · September 2025

Token

for Aria

Guardian's review of Token for Aria, published September 2025. The report records 2 findings, including 1 low and 1 informational.

Get a quote Read the full report
Published
Review window
September 23, 2025
Language
Solidity
Chains
Story, BNB Chain
Sector
Real-world assets
  • 0 Critical
  • 0 High
  • 0 Medium
  • 1 Low
  • 1 Informational

2 acknowledged

Scope

1 file in scope · 10 nSLOC
FilenSLOCLines
contracts/aria/token/Aria.sol1016

Findings 2

  1. L-01 Low Invalid ClaimAdmin__ZeroAddress Revert Best Practices Acknowledged
    Location
    contracts/claim/erc20-native/vesting/BaseVesting.sol:70

    Description

    When token_ != token, the functions releasable and vestedAmount revert with ClaimAdmin__ZeroAddress(), which does not represent the true reason for the error.

    Recommendation

    Change the revert name to match the cause of the error.

    Link to L-01
  2. I-01 Informational increaseAllowance / decreaseAllowance Discontinued Warning Acknowledged
    Location
    Global

    Description

    The OpenZeppelin team removed increaseAllowance and decreaseAllowance starting in v5.x (discussion in OZ #4583, removal confirmed Jan 2024). These functions were never part of the ERC-20 standard — they were provided by OZ as convenience helpers to mitigate approval race conditions.

    Recommendation

    • Audit dependencies: Check if the protocol or its integrators call increaseAllowance or decreaseAllowance.
    • Fallback to approve: Replace with direct approve(spender, newAmount) calls, ensuring correct allowance handling.
    • Custom restore (optional): If your protocol needs these helpers for UX, re-implement them explicitly in your token contract — but document clearly that they’re non-standard.
    Link to I-01

More from Aria

  1. ERC-20 Native and Token

     33 findings 33 findings: 1 medium, 19 low, 13 informational

  2. Contract Updates

     7 findings1 high 7 findings: 1 high, 3 medium, 1 low, 2 informational

  3. IP Real-World Assets

     27 findings4 high 27 findings: 4 high, 6 medium, 14 low, 3 informational

Put your code through the same review.

This review started with a conversation about scope. Tell us what you are building and we will plan yours with you.

Get a quote