Bit5

We express our gratitude to the Bit5 team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.

Bit5 is a Digital Asset Marketplace, providing progressive, secure, and entertaining Web3 products.

The system users should acknowledge all the risks summed up in the risks section of the report

Bit5 SCRA is a NFT Marketplace and NFT Lending Platform system with the following contracts:

• Bit5 — is a contract with the tokens marketplace functionality. During the contract initialization, the fee is set to 2% and the maximal royalty is set to 40%. The contract has a pausing functionality: it is not possible to buy tokens, accept bids or cancel the order. Orders used in the contract are created off-chain. The issuer is required to sign the order information. In the contract, those who wish to accept the order provide the order information and the issuer's signature. These data are validated, checking if the signer matches the issuer specified in the order information. Additionally, the validation ensures that the order is not expired, using the end value in the order, and verifies if the payment ERC-20 token is allowed. Once validated, the order is processed. The order can be either a LISTING or a BID, and the contract has separate functions for each type. In the case of a BID, msg.sender sells the NFT to the order issuer, while in a LISTING, it is the opposite. The service fee is collected in ERC-20 payment tokens. From the service fee, the treasury fee is deducted and sent to the Bit5Treasury contract. If the NFT supports royalties, the royalty for the token is sent. Otherwise, custom royalties can be sent. The collection owner can set collection royalties with a percentage share, with the total percentage not exceeding 40%. Additionally, the issuer can be the owner of a privileged collection. The contract owner can establish privileged collections along with their respective percentages. In such cases, the service fee is reduced by the privilege percentage, and the treasury fee is adjusted accordingly. After this, the payment tokens are sent to the seller, and the NFT is transferred to the buyer. Furthermore, the contract allows processing global BIDs. In the order information, the issuer specifies the quantity of tokens they wish to purchase from the collection, and users can sell them the corresponding quantity of any tokens from the collection.

• Bit5Lending — is a contract with the tokens borrowing and lending functionality. Orders are created and processed in the same manner as in the previous contract. The order owner has the ability to cancel their own order. Similar to the previous contract, an order can have either an OFFER (where the issuer wants to provide a loan) or a LIST (where the issuer wants to lend) type. The order object specifies an array of NFT addresses, their IDs, quantities, and types (ERC721 or ERC1155). It also includes the signingTime and expiration (the order becomes invalid after signingTime + expiration), as well as the duration (the timeframe within which the borrower must repay the debt) which is indicated in the order information. When the borrower repays the debt, they also pay the interestRate, which is specified in the order information. If the borrower fails to repay the debt, the lender who provided the loan can liquidate it (collateral NFTs are transferred to them), and the collaterals are sent to the contract at the time of order acceptance. Additionally, a loan order can be global, meaning the lender can provide a loan against any NFT from the specified collection. Upon loan initiation, a service fee is collected from the loan (initially set at 1% during contract initialization but can be modified by the owner). The contract also includes pausing functionality, which allows for the blocking of order cancellations, acceptance, payment, and liquidation operations.

• Bit5Treasury — is a contract that facilitates the collection of treasury fees from the contract, stores balances associated with an NFT collection, and allows for their withdrawal.

• Create3Factory — is a contract that provides the functionality for the contracts deployment.

• TransparentProxy — is a transparent upgradeable proxy contract.

• LibOrder.sol — provides structs and enums for the Bit5 and the LibOrder library with the order hashing function.

• LibOrderLending.sol — provides structs and enums for the Bit5 and the LibOrderLending library with the lending order hashing function.

• OrderValidator — is a contract that provides a function of obtaining the signer address from the order and signature.

• OrderValidatorLending — is a contract that provides a function of obtaining the signer address from the lending order and signature.

• Bit5Errors — is an interface that provides errors used in the Bit5 and Bit5Treasury contracts.

• IBit5Treasury — is an interface that defines Bit5Treasury contract functions.

• solmate/src/utils/CREATE3 — is a contract that provides the functionality for the contracts deployment.

• solmate/src/utils/Bytes32AddressLib — is a library for converting addresses to bytes32 and vice versa.

Privileged roles

• The owner of the Bit5 contract can withdraw native coin and ERC-20 tokens from the contract, allow and disallow payment tokens, pause and unpause the contract, change service fee, set privileged NFT collections with percentages, and change treasury fee percentages.

• The owner of the Bit5 contract can acceptGlobalBidAsOwner on behalf of any user.

• The owner of the Bit5Lending contract can withdraw native coin and ERC-20 tokens from the contract, allow and disallow payment tokens, pause and unpause the contract, change the service fee, set payment tokens statuses.

• The owner of the Bit5Treasury contract can set bit5 address and withdraw fees from the contract.

• The bit5 address in the Bit5Treasury contract can call a deposit function (that transfers treasury fee to this contract).

The total Documentation quality score is 8 out of 10.

• Functional requirements are provided and are sufficient.

• The technical description is limited:

• • The technical specification is not provided.

  • NatSpec is missing.

The total Code quality score is 8 out of 10.

• Insufficient Gas modeling.

• Solidity Style Guide violations (code formatting, naming conventions).

Code coverage of the project is 94.35% (branch coverage).

Upon auditing, the code was found to contain 1 critical, 13 high, 3 medium, and 6 low severity issues. Out of these, 18 issues have been addressed and resolved, leading to a Security score of 10 out of 10.

All identified issues are detailed in the “Findings” section of this report.

The comprehensive audit of the customer's smart contract yields an overall score of 9.2. This score reflects the combined evaluation of documentation, code quality, test coverage, and security aspects of the project.

The scope of the project includes the following smart contracts from the provided repository:

Contracts in Scope