Audit name:
[SCA] CoinStir | EIP712 | Feb2024
Date:
Mar 21, 2024
Table of Content
Introduction
We express our gratitude to the CoinStir team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.
CoinStir is a privacy enabling app that allows users to send ETH or ERC20 tokens to other wallets without recipiants being able to see the senders address. Additionally CoinStir allows for a network of wallets to be created and managed from one dashboard to assist in managing personal or business finances. Financial privacy is instrumental in a multide of business and personal relationships, and while the open nature of the blockchain is often superior, there are instances in which privacy remains critical.
| title | content |
|---|---|
| Platform | Ethereum, Sapphire ParaTime on Oasis Network |
| Language | Solidity |
| Tags | EIP712, Signatures, Meta Transactions, Bridge, Privacy |
| Timeline | 01/03/2024 - 29/03/2024 |
| Methodology | https://hackenio.cc/sc_methodology→ |
Review Scope | |
|---|---|
| Repository | https://github.com/itmekevin/CoinStir/→ |
| Commit | 46265344c5a12888551dbcae2a3bc9db1511ab8b |
Review Scope
- Repository
- https://github.com/itmekevin/CoinStir/→
- Commit
- 46265344c5a12888551dbcae2a3bc9db1511ab8b
Audit Summary
10/10
100%
10/10
10/10
The system users should acknowledge all the risks summed up in the risks section of the report
Document Information
This report may contain confidential information about IT systems and the intellectual property of the Customer, as well as information about potential vulnerabilities and methods of their exploitation.
The report can be disclosed publicly after prior consent by another Party. Any subsequent publication of this report shall be without mandatory consent.
Document | |
|---|---|
| Name | Smart Contract Code Review and Security Analysis Report for CoinStir |
| Audited By | Grzegorz Trawinski |
| Approved By | Przemyslaw Swiatowiec |
| Website | https://coinstir.app/→ |
| Changelog | 07/03/2024 - Preliminary Report |
| 29/03/2024 - Final Report |
Document
- Name
- Smart Contract Code Review and Security Analysis Report for CoinStir
- Audited By
- Grzegorz Trawinski
- Approved By
- Przemyslaw Swiatowiec
- Website
- https://coinstir.app/→
- Changelog
- 07/03/2024 - Preliminary Report
- 29/03/2024 - Final Report
System Overview
The CoinStir solution is a deposit system that bridges assets from Ethereum to the Sapphire ParaTime to allow confidential transfers of assets.
The StirHost.sol is an Ethereum contract that allows users to deposit funds that are going to be transferred into StirEnclave.sol contract within Sapphire ParaTime. It also has internal function that can be used by bridge to withdraw funds. This contract holds funds.
The StirEnclave.sol is receives information about user's deposit. It implements the full accounting of funds, fees, Gas usage and transfers or withdrawals. It has a functionality to approve or revoke approval for other accounts that can manage user's funds. It allows to read confidential data by authorised users. It also allows protocol owner to withdraw withdrawal and Gas fees.
The VerifyTypedData.sol is a contract with EIP712 signatures verification utilities.
The accessControl.sol is a contract that grants or revokes access rights for admins, relayers or authorised authorities.
Privileged roles
The admin of the StirHost contract can set deposit gas price, claim withdrawal and Gas fees, set fee's recipient. Additionally it has capability to blacklist users.
The relayer of the StirHost contract can trigger main functionalities of the contract, such as grant or revoke approved address for user account or transfer/withdraw funds. This is intermediate role that acts as intermediate between user interface and smart contract.
The authorised account of the StirHost contract can access the transactions history of particular user.
Executive Summary
Documentation quality
The total Documentation Quality score is 10 out of 10.
Code quality
The total Code Quality score is 10 out of 10.
Test coverage
Code coverage of the project is 100% (branch coverage).
Security score
Upon auditing, the code was found to contain 1 critical, 3 high, 2 medium, and 3 low severity issues, leading to a security score of 0 out of 10. Within the remediation phase all findings were fixed, leading to a security score of 10 out of 10.
All identified issues are detailed in the “Findings” section of this report.
Summary
The comprehensive audit of the customer's smart contract yields an overall score of 10. This score reflects the combined evaluation of documentation, code quality, test coverage, and security aspects of the project.
Risks
The solution is privacy oriented to hide information about the source of asset transfer. However, in an effort to prevent money laundering, there is the ability for oversight organisations to be granted access to review all history for any wallet.
The solutions uses Celer Network for bridging assets which is considered out of scope of this security assessment.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2024-1322 | Invalid overall ether accounting within the system | fixed | Critical | |
| F-2024-1320 | The revokeAddress function does not erease originAddress record | fixed | High | |
| F-2024-1314 | The confirmApproval function can be called multiple times for the same address | fixed | High | |
| F-2024-1267 | The confirmApproval function lacks deduction of gasPrice from user balance | fixed | High | |
| F-2024-1301 | Loss of precision when calculating the fee | fixed | Medium | |
| F-2024-1280 | The deposit function lacks minimum deposit value check | fixed | Medium | |
| F-2024-1323 | StirEnclave can not handle ICelerMessageBus fee payment | fixed | Low | |
| F-2024-1316 | The approvalCheck function can disclose confidential information | fixed | Low | |
| F-2024-1287 | Various functions may revert due to wrong assertion check | fixed | Low | |
| F-2024-1317 | Signature verification contract can return address zero | accepted | Observation |
Appendix 1. Severity Definitions
When auditing smart contracts, Hacken is using a risk-based approach that considers Likelihood, Impact, Exploitability and Complexity metrics to evaluate findings and score severities.
Reference on how risk scoring is done is available through the repository in our Github organization:
Severity | Description |
|---|---|
Critical | Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation. |
High | High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation. |
Medium | Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category. |
Low | Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score. |
Severity
- Critical
Description
- Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.
Severity
- High
Description
- High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.
Severity
- Medium
Description
- Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.
Severity
- Low
Description
- Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score.
Appendix 2. Scope
The scope of the project includes the following smart contracts from the provided repository:
Scope Details | |
|---|---|
| Repository | https://github.com/itmekevin/CoinStir/→ |
| Commit | 46265344c5a12888551dbcae2a3bc9db1511ab8b |
| Whitepaper | https://github.com/itmekevin/CoinStir/blob/main/README.md→ |
| Requirements | https://github.com/itmekevin/CoinStir/blob/main/Functional%20Requirements.md→ |
| Technical Requirements | NatSpec comments |
Scope Details
- Repository
- https://github.com/itmekevin/CoinStir/→
- Commit
- 46265344c5a12888551dbcae2a3bc9db1511ab8b
- Technical Requirements
- NatSpec comments