AugmentLabs

We express our gratitude to the AugmentLabs team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.

AugmentLabs has developed a stablecoin protocol called AGC with an Automated Marketcap Comparison (AMCF). The protocol was constructed to be novel and resilient to attacks of all forms by addressing fundamental issues of existing designs and having dynamic systems that can change the underlying way in which the algorithmic system reacts to an attack vector, especially a massive depegging event.

The system users should acknowledge all the risks summed up in the risks section of the report

AugmentLabs is a mixed-purpose ERC20/Stacking system with the following contracts:

• AGC — upgradable ERC-20 token that mints all initial supply to a deployer. Minting and burning is allowed by the Minter on demand. It has the following attributes:

• • Name: AGC

  • Symbol: AGC

  • Differences from the ERC20 standard: the token is not transferable.

• USC — upgradable ERC-20 token that mints all initial supply to a deployer. Minting is allowed by the Minter on demand. It has the following attributes:

• • Name: USC

  • Symbol: USC

  • Other parameters are default for the ERC20 standard

• TokenController — an upgradable smart contract that will have MINTER_ROLE of AGC & USC to perform the redeem functionality between AGC/USC.

• • Has a safety switch.

  • Role-based authentication.

  • Can burn USC and mint AGC to a specific user address.

  • Can burn AGC and mint USC to a specific user address.

• MasterChef — an upgradable smart contract that allows users to stake USDT and get USC rewards at a specified ROI/year.

• • Has a safety switch.

  • Can mint USC to yield rewards to pool stakers.

Privileged roles

• The MasterChef contact has a single owner role.

• The TokenController contract has PAUSERROLE, UPGRADERROLE and REDEEMERROLE roles and must take the MINTERROLE of USC and AGC.

• The MINTER_ROLE of AGC and USC can mint tokens on demand without any restrictions. The burn functions in USC are unprotected.

Recommendations

• The system relies on the security of the privileged roles’ private keys, which can impact the execution flow and security of the funds. We recommend those accounts to be at least ⅗ multi-sig.

The total Documentation quality score is 10 out of 10.

• A Whitepaper is provided.

• NatSpec is included in the code.

• Technical description and functional requirements are provided.

The total Code quality score is 9 out of 10.

• The development environment is configured.

• 5 out of 103 tests are failing.

Code coverage of the project is 84.94% (branch coverage).

• Deployment and basic user interactions are covered with tests.

• Negative cases coverage is present.

Upon auditing, the code was found to contain 1 critical, 5 high, 7 medium, and 16 low severity issues. Out of these, 29 issues have been addressed and resolved, leading to a Security score of 10 out of 10.

All identified issues are detailed in the “Findings” section of this report.

The comprehensive audit of the customer's smart contract yields an overall score of 9.3. This score reflects the combined evaluation of documentation, code quality, test coverage, and security aspects of the project.

The scope of the project includes the following smart contracts from the provided repository:

Contracts in Scope