Q1 2025 Web3 Security ReportAccess control failures led to $1.63 billion in losses
Discover report insights
  • Hacken
  • Audits
  • brickken
  • [SCA] Brickken / Protocol / Dec2023
Brickken logo

Brickken

Audit name:

[SCA] Brickken / Protocol / Dec2023

Date:

Feb 15, 2024

Table of Content

→Introduction
→Audit Summary
→Document Information
→System Overview
→Executive Summary
→Risks
→Findings
→Appendix 1. Severity Definitions
→Appendix 2. Scope
→Disclaimer

Want a comprehensive audit report like this?

Introduction

We express our gratitude to the Brickken team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.

Brickkenis a solution that provides tools for tokenization of real-world assets, equity, debt and securities.

titlecontent
LanguageSolidity
TagsERC20, Escrow, Tokenization, Factory
Timeline15/01/2024 - 14/02/2024
Methodologyhttps://hackenio.cc/sc_methodology→

    Review Scope

    Repositoryhttps://github.com/Brickken/brickken-protocol→
    Initial Commita4e024b68436ccfcd2d152c47e6179f09fd2d779
    Final Remediation Commitc88c984faaf92c8c841fe129ba214e9bc657fec0

    Audit Summary

    Total9.9/10
    Security Score

    10/10

    Test Coverage

    97.9%

    Code Quality Score

    10/10

    Documentation Quality Score

    10/10

    26Total Findings
    25Resolved
    1Accepted
    0Mitigated

    Audit Summary

    The system users should acknowledge all the risks summed up in the risks section of the report

    Document Information

    This report may contain confidential information about IT systems and the intellectual property of the Customer, as well as information about potential vulnerabilities and methods of their exploitation.

    The report can be disclosed publicly after prior consent by another Party. Any subsequent publication of this report shall be without mandatory consent.

    Document

    NameSmart Contract Code Review and Security Analysis Report for Brickken
    Audited ByNiccolò Pozzolini, Kornel Światłowski
    Approved ByPrzemyslaw Swiatowiec
    Websitehttps://www.brickken.com/→
    Changelog30/01/2024 - Preliminary Report; 14/02/2024 Second Review

    • Document

      Name
      Smart Contract Code Review and Security Analysis Report for Brickken
      Audited By
      Niccolò Pozzolini, Kornel Światłowski
      Approved By
      Przemyslaw Swiatowiec
      Website
      https://www.brickken.com/→
      Changelog
      30/01/2024 - Preliminary Report; 14/02/2024 Second Review

    System Overview

    The Brickken system comprises a factory responsible for generating new instances of an escrow contract and a token contract whenever new tokenization occurs.

    Entities authorized to initiate new tokenizations, referred to as issuers, undergo KYC procedures conducted by Brickken. Upon successful verification, issuers are whitelisted in the factory, enabling them to conduct tokenizations. Following issuer whitelisting and the initiation of a new tokenization, both an escrow contract and a token are created. The escrow contract facilitates token offerings, while the token itself incorporates additional functionalities such as dividend distribution and confiscation, while adhering to the ERC20 standard.

    Each escrow contract features a base "payment token" in which the issuer withdraws all escrowed funds from investors. Investors can utilize the same payment token for investment or any whitelisted ERC20 tokens. The issuer has the flexibility to modify the whitelist, and each ERC20 token eligible for investment must have a Uniswap v3 pool against the base payment token to facilitate the system's operation. The designated "payment token" is intended to be a stablecoin, although it can take any form as long as a valid Chainlink price feed is available.

    Every STO contract is upgradeable. While upgrade capabilities are currently centralized, Brickken is planning to develop a DAO to empower the community with decisional powers on protocol upgrades.

    Privileged roles

    STOFactory

    • DEFAULTADMINROLE = grant/revoke roles (brickken)

    • FACTORYWHITELISTERROLE = allow whitelisting (brickken);

    • FACTORYISSUERROLE = whitelisted issuers (brickken by default);

    • FACTORYPAUSERROLE = pause / unpause factory (brickken);

    STOToken

    • DEFAULTADMINROLE = grant/revoke roles (brickken)

    • TOKENURLROLE = change url (brickken,issuer);

    • TOKENDIVIDENDDISTRIBUTOR_ROLE = distribute dividend (issuer)

    • TOKENMINTERROLE = mint new tokens (issuer, escrow contract)

    • TOKENMINTERADMIN_ROLE = add/remove minters (issuer)

    • TOKENWHITELISTADMIN_ROLE = change investors whitelist (issuer)

    • TOKENWHITELISTROLE = whether the user is whitelisted or not (issuer)

    • TOKENCONFISCATEEXECUTOR_ROLE = execute confiscation (brickken)

    • TOKENCONFISCATEADMIN_ROLE = pause / unpause or disable confiscation (brickken)

    STOEscrow:

    • DEFAULTADMINROLE = grant/revoke roles (brickken)

    • ESCROWWITHDRAWROLE = who can withdraw / partially withdraw to issuer (issuer)

    • ESCROWNEWOFFERING_ROLE = starts a new offering (issuer)

    • ESCROWOFFERINGFINALIZER_ROLE = finalize an offering (brickken, issuer)

    • ESCROWERC20WHITELISTROLE = add/remove ERC20 from whitelist (brickken, issuer);

    • ESCROWOFFCHAINREPORTER_ROLE = report offchain USD tickets for current offering (issuer)

    Executive Summary

    Documentation quality

    The total Documentation Quality score is 10 out of 10.

    • Functional requirements are detailed.

    • Technical description is robust.

    Code quality

    The total Code Quality score is 10 out of 10.

    • The development Environment is configured.

    Test coverage

    Code coverage of the project is 97.9% (branch coverage).

    • Deployment and basic user interactions are covered with tests.

    • Negative test cases are included.

    Security score

    Upon auditing, the code was found to contain 0 critical, 0 high, 6 medium, and 8 low severity issues. All issues were fixed in the remediation phase of an audit, leading to a security score of 10 out of 10.

    All identified issues are detailed in the “Findings” section of this report.

    Summary

    The comprehensive audit of the customer's smart contract yields an overall score of 9.9. This score reflects the combined evaluation of documentation, code quality, test coverage, and security aspects of the project.

    Risks

    The withdrawal fees in the STOEscrowUpgradeable.sol smart contract are only constrained to be less than 100% (as indicated by the MAX_FEE_LIMIT).

    Findings

    Code
    ―
    Title
    Status
    Severity
    F-2024-0599Incorrect Role Assignment in initialize() Function in the STOTokenManagedUpgradeable Contract
    fixed

    Medium
    F-2024-0598Unclaimed Dividends Affected by _changePaymentToken() Invocation in STOTokenDividendUpgradeable.sol
    fixed

    Medium
    F-2024-0595Potential Frontrunning Vulnerability in _addDistDividend() Function in STOTokenDividendUpgradeable.sol
    fixed

    Medium
    F-2024-0587Potential Disruption of Open Positions due to _setPaymentToken() Function in STOEscrowUpgradeable.sol
    fixed

    Medium
    F-2024-0586Potential Blocking of STO Token Minting by Issuer in STOEscrowUpgradeable.sol
    fixed

    Medium
    F-2024-0561Inconsistent Definition of maxSupply in STOToken Contracts leads to maxSupply not being enforced
    fixed

    Medium
    F-2024-0623Missing Data Validation
    fixed

    Low
    F-2024-0610Missing checks for zero address
    fixed

    Low
    F-2024-0596Accumulation of Dividends by Blacklisted Users
    fixed

    Low
    F-2024-0589Potential Price Manipulation in getBKNPrice() Function in STOFactoryUpgradeable.sol
    accepted

    Low
    1-10 of 26 findings

    Identify vulnerabilities in your smart contracts.

    Appendix 1. Severity Definitions

    When auditing smart contracts, Hacken is using a risk-based approach that considers Likelihood, Impact, Exploitability and Complexity metrics to evaluate findings and score severities.

    Reference on how risk scoring is done is available through the repository in our Github organization:

    Severity

    Description

    Critical
    		Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.

    High
    		High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.

    Medium
    		Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.

    Low
    		Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score.

    • Severity

      Critical

      Description

      Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.

      Severity

      High

      Description

      High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.

      Severity

      Medium

      Description

      Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.

      Severity

      Low

      Description

      Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score.

    Appendix 2. Scope

    The scope of the project includes the following smart contracts from the provided repository:

    Contracts in Scope

    contracts
    sto
    UpgradeableBeacon
    UpgradeableBeaconEscrow.sol - contracts/sto/UpgradeableBeacon/UpgradeableBeaconEscrow.sol
    UpgradeableBeaconToken.sol - contracts/sto/UpgradeableBeacon/UpgradeableBeaconToken.sol
    UpgradeableTemplate
    escrow
    STOEscrowManagedUpgradeable.sol - contracts/sto/UpgradeableTemplate/escrow/STOEscrowManagedUpgradeable.sol
    STOEscrowUpgradeable.sol - contracts/sto/UpgradeableTemplate/escrow/STOEscrowUpgradeable.sol
    factory
    STOFactory.sol - contracts/sto/UpgradeableTemplate/factory/STOFactory.sol
    STOFactoryManaged.sol - contracts/sto/UpgradeableTemplate/factory/STOFactoryManaged.sol
    token
    STOTokenCheckpointsUpgradeable.sol - contracts/sto/UpgradeableTemplate/token/STOTokenCheckpointsUpgradeable.sol
    STOTokenConfiscateUpgradeable.sol - contracts/sto/UpgradeableTemplate/token/STOTokenConfiscateUpgradeable.sol
    STOTokenDividendUpgradeable.sol - contracts/sto/UpgradeableTemplate/token/STOTokenDividendUpgradeable.sol
    STOTokenManagedUpgradeable.sol - contracts/sto/UpgradeableTemplate/token/STOTokenManagedUpgradeable.sol
    STOTokenUpgradeable.sol - contracts/sto/UpgradeableTemplate/token/STOTokenUpgradeable.sol
    helpers
    BeaconProxy.sol - contracts/sto/helpers/BeaconProxy.sol
    Errors.sol - contracts/sto/helpers/Errors.sol
    PriceAndSwapManager.sol - contracts/sto/helpers/PriceAndSwapManager.sol

    Disclaimer