Q1 2026 Security & Compliance Report44 incidents, $482M in losses, insights from 11 industry leaders.
Read the report

Acta Finance

Audit name:

[SCA] Acta Finance | Staking | Apr2022

Date:

May 11, 2022

Table of Content

→Introduction
→Audit Summary
→Document Information
→System Overview
→Executive Summary
→Findings
→Appendix 1. Severity Definitions
→Appendix 2. Scope
→Disclaimer

Want a comprehensive audit report like this?

Introduction

We express our gratitude to the Acta Finance team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.

Acta Finance is a DeFi ecosystem that brings innovation to the DeFi industry by motivating users to build a referral network that rewards user network, and user activity, through the referral system and address milestones.

titlecontent
PlatformEVM
LanguageSolidity
Timeline12/04/2022 - 13/05/2022
Methodologyhttps://hackenio.cc/sc_methodology→

    Review Scope

    Repositoryhttps://github.com/P2P-Finance/nft-wrapped-staking.git→
    Commit3570670c9ada20ed7f502414c40274711698bbf7

    Audit Summary

    Total9.5/10
    Security Score

    10/10

    Test Coverage

    10/10

    Code Quality Score

    10/10

    Documentation Quality Score

    5/10

    9Total Findings
    7Resolved
    1Accepted
    0Mitigated

    The system users should acknowledge all the risks summed up in the risks section of the report

    Document Information

    This report may contain confidential information about IT systems and the intellectual property of the Customer, as well as information about potential vulnerabilities and methods of their exploitation.

    The report can be disclosed publicly after prior consent by another Party. Any subsequent publication of this report shall be without mandatory consent.

    Document

    NameSmart Contract Code Review and Security Analysis Report for Acta Finance
    Audited ByHacken
    Websitehttps://actafi.org/→
    Changelog15/04/2022 - Initial Review
    29/04/2022 - Second Review
    13/05/2022 - Third Review

    • Document

      Name
      Smart Contract Code Review and Security Analysis Report for Acta Finance
      Audited By
      Hacken
      Website
      https://actafi.org/→
      Changelog
      15/04/2022 - Initial Review
      29/04/2022 - Second Review
      13/05/2022 - Third Review

    System Overview

    Acta Finance is a DeFi ecosystem that brings innovation to the DeFi industry by motivating users to build a referral network that rewards user network, and user activity, through the referral system and address milestones. ActaFi Swap is a cross-chain liquidity aggregator that offers margin trading that receives the margin from peer-to-peer lending offers, introducing a new investment opportunity for the users.

    • WrappedNftStakingPool — a contract that rewards users for staking their ACTA tokens. APY is defined during the contract creation and does not change during the lifetime. After token staking user will receive an Acta NFT as proof of staking. The staking lock period is defined during the creation. The staking poll is limited to the amount of tokens defined during contract creation.

    Privileged roles

    • The owner of the WrappedNftStakingPool can withdraw excess tokens from the rewards pool.

    Executive Summary

    Documentation quality

    The total Documentation quality score is 5 out of 10.

    • The Customer provided a whitepaper with functional requirements. The whitepaper does not contain any information about NFTs.

    Code quality

    The total Code quality score is 10 out of 10.

    • The code is well commented and well covered with unit tests.

    Architecture quality

    The Architecture quality score is 10 out of 10.

    • The project has clear and clean architecture.

    Security score

    Upon auditing, the code was found to contain 0 critical, 1 high, 1 medium, and 7 low severity issues. The final security score is 10 out of 10.

    All identified issues are detailed in the “Findings” section of this report.

    Summary

    The comprehensive audit of the customer's smart contract yields an overall score of 9.5 This score reflects the combined evaluation of documentation, code quality, test coverage, and security aspects of the project.

    Scoring Methodologyarrow right

    Findings

    Code
    ―
    Title
    Status
    Severity
    F-2022-1543Insufficient rewards balance
    accepted

    High
    F-2022-1544Replace transferFrom with transfer
    fixed

    Medium
    F-2022-1551Code organization
    fixed

    Low
    F-2022-1550Redundancy
    fixed

    Low
    F-2022-1549Remove the nonReentrant modifier to save gas
    fixed

    Low
    F-2022-1548Deposit function allows using any NTF image URI
    unfixed

    Low
    F-2022-1547Public function that could be declared external
    fixed

    Low
    F-2022-1546Floating Pragma
    fixed

    Low
    F-2022-1545Unused variable
    fixed

    Low
    1-9 of 9 findings

    Identify vulnerabilities in your smart contracts.

    Appendix 1. Severity Definitions

    When auditing smart contracts, Hacken is using a risk-based approach that considers Likelihood, Impact, Exploitability and Complexity metrics to evaluate findings and score severities.

    Reference on how risk scoring is done is available through the repository in our Github organization:

    Severity

    Description

    Critical
    		Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.

    High
    		High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.

    Medium
    		Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.

    Low
    		Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score.

    • Severity

      Critical

      Description

      Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.

      Severity

      High

      Description

      High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.

      Severity

      Medium

      Description

      Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.

      Severity

      Low

      Description

      Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score.

    Appendix 2. Scope

    The scope of the project includes the following smart contracts from the provided repository:

    Scope Details

    Repositoryhttps://github.com/P2P-Finance/nft-wrapped-staking.git→
    Commit3570670c9ada20ed7f502414c40274711698bbf7
    WhitepaperProvided
    Technical RequirementsProvided

    Contracts in Scope

    contracts
    WrappedNftStakingPool.sol - contracts › WrappedNftStakingPool.sol

    Disclaimer

    Acta Finance audit by Hacken