- Hacken
- Audits
- evervalue-coin
- [SCA] EverValueCoin | OrderBook | Oct2025
Audit name:
[SCA] EverValueCoin | OrderBook | Oct2025
Date:
Nov 18, 2025
Table of Content
Introduction
We express our gratitude to the EverValue Coin team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.
EverValueCoin's OrderBook is a decentralized exchange order book system: on-chain limit order matching for trading pairs with red-black tree price levels, FIFO queues per price, fee collection, and trader balance management.
Document | |
|---|---|
| Name | Smart Contract Code Review and Security Analysis Report for EverValue Coin |
| Audited By | Seher Saylik, Khrystyna Tkachuk |
| Approved By | Ataberk Yavuzer |
| Website | https://evervaluecoin.com/→ |
| Changelog | 04/11/2025 - Preliminary Report |
| 18/11/2025 - Final Report | |
| Platform | Arbitrum network |
| Language | Solidity |
| Tags | OrderBook, ERC-20, DEX |
| Methodology | https://docs.hacken.io/methodologies/smart-contracts→ |
Document
- Name
- Smart Contract Code Review and Security Analysis Report for EverValue Coin
- Audited By
- Seher Saylik, Khrystyna Tkachuk
- Approved By
- Ataberk Yavuzer
- Website
- https://evervaluecoin.com/→
- Changelog
- 04/11/2025 - Preliminary Report
- 18/11/2025 - Final Report
- Platform
- Arbitrum network
- Language
- Solidity
- Tags
- OrderBook, ERC-20, DEX
Review Scope | |
|---|---|
| Repository | https://github.com/devervalue/orderbook→ |
| Commit | 0c7c8686c79ba951fedb3173822077b159b3829b |
| Retest | cce93d45a2d6bccc77c9fb9a4f86508f814322be |
Review Scope
- Repository
- https://github.com/devervalue/orderbook→
- Commit
- 0c7c8686c79ba951fedb3173822077b159b3829b
- Retest
- cce93d45a2d6bccc77c9fb9a4f86508f814322be
Audit Summary
The system users should acknowledge all the risks summed up in the risks section of the report
Documentation quality
Functional requirements are provided.
Technical description is provided.
Code quality
The development environment is configured.
Test coverage
Code coverage of the project is 100% (branch coverage).
Deployment and basic user interactions are covered with tests.
Negative cases coverage is covered.
Interactions by several users are tested thoroughly.
System Overview
The OrderBook Smart Contract is an on-chain decentralized exchange (DEX) implementation that aims to provide a fully transparent and efficient trading platform for ERC20 tokens. Unlike traditional Automated Market Maker (AMM) based DEXes, this system implements a limit order book model, similar to those used in centralized exchanges.
OrderBookFactory — main orderbook contract that manages the creation and administration of order books for trading pairs, allowing users to place and manage buy/sell orders efficiently. It supports features like adding new pairs, updating fees, pausing operations.
OrderBookLib — A library for managing an order book.
PairLib — A library designed for managing trading pairs and their associated order books in decentralized exchanges. It supports creating, canceling, and matching buy/sell orders while handling functionalities such as maintaining trader-specific registries, tracking order states, and calculating trading fees.
Privileged roles
The owner role can add new pairs, change the enabled status for a trading pair, update the fee for a specific trading pair, set a new fee recipient address for a specific order book, and pause/unpause the contract.
Potential Risks
The lack of multi-signature requirements for key operations centralizes decision-making power, increasing vulnerability to single points of failure or malicious insider actions, potentially leading to unauthorized transactions or configuration changes.
The reliance on off-chain price management and user responsibility for accurate decimals handling introduces a potential risk of incorrect price submissions, which might result in token mispricing. Without on-chain validation or adjustment for token decimals, the system remains susceptible to errors or exploitation if backend systems or user inputs are compromised.
The matchOrder function's loop, while capped at 1500 iterations, poses a potential DoS risk as processing large orders involving numerous matching transactions could consume excessive gas. This may prevent the completion of order processing, disrupting contract operations for legitimate users.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2025-1384 | Excess Quote Tokens Remain Locked When Execution Price Deviates from Order Price | fixed | Critical | |
| F-2025-1383 | Zero-amount Settlements And Permanent Loss Of Quote Remainders | accepted | Medium | |
| F-2025-1382 | Unused Custom Errors and Imports | fixed | Observation | |
| F-2025-1382 | Redundant Event Emitting in pause() and unpause() Functions | fixed | Observation |
Appendix 1. Definitions
Severities
When auditing smart contracts, Hacken is using a risk-based approach that considers Likelihood, Impact, Exploitability and Complexity metrics to evaluate findings and score severities.
Reference on how risk scoring is done is available through the repository in our Github organization:
Severity | Description |
|---|---|
Critical | Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation. |
High | High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation. |
Medium | Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category. |
Low | Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution. |
Severity
- Critical
Description
- Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.
Severity
- High
Description
- High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.
Severity
- Medium
Description
- Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.
Severity
- Low
Description
- Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution.
Potential Risks
The "Potential Risks" section identifies issues that are not direct security vulnerabilities but could still affect the project’s performance, reliability, or user trust. These risks arise from design choices, architectural decisions, or operational practices that, while not immediately exploitable, may lead to problems under certain conditions. Additionally, potential risks can impact the quality of the audit itself, as they may involve external factors or components beyond the scope of the audit, leading to incomplete assessments or oversight of key areas. This section aims to provide a broader perspective on factors that could affect the project's long-term security, functionality, and the comprehensiveness of the audit findings.
Appendix 2. Scope
The scope of the project includes the following smart contracts from the provided repository:
Scope Details | |
|---|---|
| Repository | https://github.com/devervalue/orderbook→ |
| Commit | 0c7c8686c79ba951fedb3173822077b159b3829b |
| Retest | cce93d45a2d6bccc77c9fb9a4f86508f814322be |
| Whitepaper | https://evervaluecoin.com/white-paper/→ |
| Requirements | https://github.com/devervalue/orderbook/blob/master/README.md→ |
| Technical Requirements | https://github.com/devervalue/orderbook/blob/master/README.md→ |
Scope Details
- Repository
- https://github.com/devervalue/orderbook→
- Commit
- 0c7c8686c79ba951fedb3173822077b159b3829b
- Retest
- cce93d45a2d6bccc77c9fb9a4f86508f814322be
- Whitepaper
- https://evervaluecoin.com/white-paper/→
- Technical Requirements
- https://github.com/devervalue/orderbook/blob/master/README.md→
Assets in Scope
Appendix 3. Additional Valuables
Additional Recommendations
The smart contracts in the scope of this audit could benefit from the introduction of automatic emergency actions for critical activities, such as unauthorized operations like ownership changes or proxy upgrades, as well as unexpected fund manipulations, including large withdrawals or minting events. Adding such mechanisms would enable the protocol to react automatically to unusual activity, ensuring that the contract remains secure and functions as intended.
To improve functionality, these emergency actions could be designed to trigger under specific conditions, such as:
Detecting changes to ownership or critical permissions.
Monitoring large or unexpected transactions and minting events.
Pausing operations when irregularities are identified.
These enhancements would provide an added layer of security, making the contract more robust and better equipped to handle unexpected situations while maintaining smooth operations.
Frameworks and Methodologies
This security assessment was conducted in alignment with recognised penetration testing standards, methodologies and guidelines, including the NIST SP 800-115 – Technical Guide to Information Security Testing and Assessment →, and the Penetration Testing Execution Standard (PTES) →, These assets provide a structured foundation for planning, executing, and documenting technical evaluations such as vulnerability assessments, exploitation activities, and security code reviews. Hacken’s internal penetration testing methodology extends these principles to Web2 and Web3 environments to ensure consistency, repeatability, and verifiable outcomes.