Audit name:
[SCA] BlastUp / Launchpad / Apr2024
Date:
May 15, 2024
Table of Content
Introduction
We express our gratitude to the BlastUp team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.
BlastUP is a launchpad and staking platform within the Blast blockchain ecosystem.
| title | content |
|---|---|
| Platform | Blast(EVM) |
| Language | Solidity |
| Tags | Blast, Launchpad, IDO, Staking |
| Timeline | 24/04/2024 - 26/04/2024 |
| Methodology | https://hackenio.cc/sc_methodology→ |
Review Scope | |
|---|---|
| Repository | https://github.com/blastupio/launchpad-contracts→ |
| Commit | cb6957d |
Review Scope
- Commit
- cb6957d
Audit Summary
10/10
75%
9/10
10/10
The system users should acknowledge all the risks summed up in the risks section of the report
Document Information
This report may contain confidential information about IT systems and the intellectual property of the Customer, as well as information about potential vulnerabilities and methods of their exploitation.
The report can be disclosed publicly after prior consent by another Party. Any subsequent publication of this report shall be without mandatory consent.
Document | |
|---|---|
| Name | Smart Contract Code Review and Security Analysis Report for BlastUp |
| Audited By | Eren Gonen |
| Approved By | Ataberk Yavuzer, Kaan Caglan |
| Website | https://blastup.io/→ |
| Changelog | 06/05/2024 - Preliminary Report |
| 09/05/2024 - Final Report |
Document
- Name
- Smart Contract Code Review and Security Analysis Report for BlastUp
- Audited By
- Eren Gonen
- Approved By
- Ataberk Yavuzer, Kaan Caglan
- Website
- https://blastup.io/→
- Changelog
- 06/05/2024 - Preliminary Report
- 09/05/2024 - Final Report
System Overview
BlastUP is a launchpad and staking platform within the Blast blockchain ecosystem with the following contracts:
Launchpad — The Launchpad contract, built with upgradeable ownership, primarily facilitates the management of token sales on a blockchain platform. It supports different user tiers, each with specific minimum amounts and weights that influence their participation in token sales. The contract interacts with an oracle for pricing conversions and handles registrations, sales, and the claiming of tokens based on sale conditions and user eligibility. LaunchpadV2 — The 2.0 version of Launchpad contract. Users able to register their tier and allocations according to the staked amount on BLPStaking.sol and Inherits Launchpad.sol. YieldStaking — The contract manages staking through an elaborate system of indexed mappings and struct arrays that track individual and total stakes, including accrued rewards and withdrawal timelines. Functionally, the contract allows users to deposit tokens into specific pools (USDB and WETH), where these tokens are then "locked" with an associated timer that dictates when they can be withdrawn. Reward calculations are dynamically adjusted through the integration with rebasing mechanisms of the staked tokens, allowing the contract to update the staking index based on the tokens’ new supply metrics after each rebase event.
Privileged roles
The owner of the Launchpad contract can:
Set a new signer address.
Set a new operator address.
Place tokens for a new sale event.
The owner and operator of the Launchpad contract can:
Set new amounts for user tiers.
Set new weights for user tiers.
Set new registration start and end times.
Set a new public sale start time.
Set new FCFS sale start and end times.
Set a new tge start time.
Set a new vesting start time.
Claim remainders after a sale ends.
The owner of the YieldStaking contract can:
Set the minimum USDB value for stakes.
Set the minimum time required before withdrawals can be made .
Executive Summary
Documentation quality
The total Documentation Quality score is 10 out of 10.
Functional requirements are partially missed.
Use case are provided.
System roles are documented.
Technical description is not provided.
Descriptions of the development environment is provided.
NatSpec are sufficient.
The Launchpad, LaunchpadV2 description is provided.
The YieldStaking description is provided.
Code quality
The total Code Quality score is 9 out of 10.
The development environment is configured.
The majority of functions rely on admin actions rather than implementing governance structures for decision-making.
Test coverage
Code coverage of the project is 75%.
Coverage tool couldn't be run due to errors.
During the manual inspection, it was identified that unit and fuzz testing are implemented, but integration tests are absent, leading to the oversight of crucial scenarios. For example, in claim fuzz testing, the contract consistently returns zero for user rewards, and fuzz testing successfully claims this zero reward.
Security score
Upon auditing, the code was found to contain 0 critical, 0 high, 2 medium, and 9 low severity issues, leading to a security score of 10 out of 10.
All identified issues are detailed in the “Findings” section of this report.
Summary
The comprehensive audit of the customer's smart contract yields an overall score of 8.8. This score reflects the combined evaluation of documentation, code quality, test coverage, and security aspects of the project.
Risks
Verification Limitations of Backend KYC: KYC verification done via the backend cannot be verified.
Challenges in Synchronized Reward Distribution: The reward distribution is based on index updates; therefore, if two users deposit at different timestamps but the index is not updated before and after when the second user deposits, the system treats them as if they deposited simultaneously.
Absence of Time-lock Mechanisms for Critical Operations: Without time-locks on critical operations, there is no buffer to review or revert potentially harmful actions, increasing the risk of rapid exploitation and irreversible changes.
Absence of Pausable Feature for Unexpected Events: Without the pausable feature, the contract cannot be immediately paused in the event of unexpected occurrences.
Owner's Unrestricted State Modification: The absence of restrictions on state variable modifications by the owner leads to arbitrary changes, affecting contract integrity and user trust, especially during critical operations like minting phases.
Dependency on Unaudited External Libraries: The project utilizes libraries or contracts without security audits, potentially introducing vulnerabilities. This compromises the security of the audited system, making it susceptible to attacks exploiting these external weaknesses.
Solidity Version Compatibility: The Solidity version 0.8.20 employs the recently introduced PUSH0 opcode in the Shanghai EVM. This opcode might not be universally supported across all blockchain networks and Layer 2 solutions. Thus, as a result, it might be not possible to deploy solution with version 0.8.20 >= on some blockchains.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2024-2028 | Strategic Splitting of Tokens Increases Allocation Unfairly | fixed | Medium | |
| F-2024-1535 | Signature Replay In Tier Registration | mitigated | Medium | |
| F-2024-2043 | Fee-On-Transfer Token Handling Flaw | accepted | Low | |
| F-2024-2040 | Inappropriate Handling of Decimal Precision for Tier Minimum Amounts | fixed | Low | |
| F-2024-1738 | decimals() is not a part of the ERC-20 standard | accepted | Low | |
| F-2024-1735 | Privileged Functions Susceptible to Front-Running | accepted | Low | |
| F-2024-1545 | Missing Validation of Tier Hierarchy | accepted | Low | |
| F-2024-1543 | Lack of Boundary Checks | accepted | Low | |
| F-2024-1540 | Centralization Risk For Privileged Actors | mitigated | Low | |
| F-2024-1534 | Inconsistent Validation Checks Across Token Setting Functions | accepted | Low |
Identify vulnerabilities in your smart contracts.
Appendix 1. Severity Definitions
When auditing smart contracts, Hacken is using a risk-based approach that considers Likelihood, Impact, Exploitability and Complexity metrics to evaluate findings and score severities.
Reference on how risk scoring is done is available through the repository in our Github organization:
Severity | Description |
|---|---|
Critical | Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation. |
High | High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation. |
Medium | Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category. |
Low | Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score. |
Severity
- Critical
Description
- Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.
Severity
- High
Description
- High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.
Severity
- Medium
Description
- Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.
Severity
- Low
Description
- Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score.
Appendix 2. Scope
The scope of the project includes the following smart contracts from the provided repository:
Scope Details | |
|---|---|
| Repository | https://github.com/blastupio/launchpad-contracts/tree/master→ |
| Commit | cb6957dde5944e6cfd885ceed8539140dce51a98 |
| Whitepaper | N/A |
| Requirements | https://docs.blastup.io/blastup-docs→ |
| Technical Requirements | Confidential |
Scope Details
- Commit
- cb6957dde5944e6cfd885ceed8539140dce51a98
- Whitepaper
- N/A
- Requirements
- https://docs.blastup.io/blastup-docs→
- Technical Requirements
- Confidential
Contracts in Scope
contracts/Launchpad.solcontracts/YieldStaking.solcontracts/LaunchpadV2.sol