- Hacken
- Audits
- infinite-possibilities-ip
- [SCA] BitMarketCap | NFT Membership | Dec2023
Audit name:
[SCA] BitMarketCap | NFT Membership | Dec2023
Date:
Dec 27, 2023
Table of Content
Introduction
We express our gratitude to the BitMarketCap team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.
BitMarketCap is an NFT membership program which will provide access to products and services and discounts.
| title | content |
|---|---|
| Platform | Ethereum |
| Language | Solidity |
| Tags | ERC-721 |
| Timeline | 20/11/2023 - 27/12/2023 |
| Methodology | https://hackenio.cc/sc_methodology→ |
Audit Summary
10/10
100%
9/10
10/10
The system users should acknowledge all the risks summed up in the risks section of the report
Document Information
This report may contain confidential information about IT systems and the intellectual property of the Customer, as well as information about potential vulnerabilities and methods of their exploitation.
The report can be disclosed publicly after prior consent by another Party. Any subsequent publication of this report shall be without mandatory consent.
Document | |
|---|---|
| Name | Smart Contract Code Review and Security Analysis Report for BitMarketCap |
| Audited By | Niccolò Pozzolini |
| Approved By | Przemysław Światowiec |
| Changelog | 28/11/2023 – Preliminary Report |
| 27/12/2023 – Review Report |
Document
- Name
- Smart Contract Code Review and Security Analysis Report for BitMarketCap
- Audited By
- Niccolò Pozzolini
- Approved By
- Przemysław Światowiec
- Changelog
- 28/11/2023 – Preliminary Report
- 27/12/2023 – Review Report
System Overview
BitMarketCap is an NFT membership program which will provide access to products and services and discounts. NFTs can be minted by depositing funds into the contract; the minted NFT will be tied to the USD amount deposited. Funds can be deposited in any ERC20 previously whitelisted by the contract administrators.
Privileged roles
The owner of the BitMarketCap contract can:
Update the funds recipient.
Enable/Disable the NFT minting.
Enable/Disable the NFT replenishment functionality.
Set the NFT base uri.
Set the token URI of any minted NFT.
Add/Remove ERC20 tokens from the whitelist.
The owner of PriceFeedOracle can:
Update the TWAP time window.
Add/Remove ERC20 swap paths.
Executive Summary
Documentation quality
The total Documentation quality score is 10 out of 10.
Functional requirements are provided and complete.
Technical description is provided and complete.
NatSpec is provided.
Code quality
The total Code quality score is 9 out of 10.
Some informational issues have to be resolved (I-2023-0459, I-2023-0462).
The development environment is configured.
Test coverage
Code coverage of the project is 100% (branch coverage).
Security score
Upon auditing, the code was found to contain 0 critical, 0 high, 1 medium, and 1 low severity issues. Out of these, 1 issues have been addressed and resolved, leading to a security score of 10 out of 10.
All identified issues are detailed in the “Findings” section of this report.
Summary
The comprehensive audit of the customer's smart contract yields an overall score of 9.8. This score reflects the combined evaluation of documentation, code quality, test coverage, and security aspects of the project.
Risks
The project makes use of Time-Weighted Average Price (TWAP) to compute the value of deposited ERC20. Such functionality shall be used very carefully as TWAP can be manipulated especially if the liquidity is not deep, special attention should be devoted to inspecting the liquidity of the pools meant to be used.
When computing the USD value of the provided ERC20, the contract assumes 1$ if the ERC20 is a whitelisted stablecoin. This exposes the protocol to the stablecoins depeg risk.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2023-1756 | Requirement Violation, MAX_TOKENS Is Not Enforced | fixed | Medium | |
| F-2023-175 | Unvalidated Parameters | accepted | Low | |
| I-2023-0463 | Missing Whitelisting For Native Token | mitigated | Observation | |
| I-2023-0462 | Missing Event Emitting | accepted | Observation | |
| I-2023-0461 | Redundant ECDSA Import Statement | fixed | Observation | |
| I-2023-0460 | Redundant _msgSender(), Meta-Transactions Not Implemented | fixed | Observation | |
| I-2023-0459 | Floating Pragma Version | accepted | Observation |
Appendix 1. Severity Definitions
When auditing smart contracts, Hacken is using a risk-based approach that considers Likelihood, Impact, Exploitability and Complexity metrics to evaluate findings and score severities.
Reference on how risk scoring is done is available through the repository in our Github organization:
Severity | Description |
|---|---|
Critical | Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation. |
High | High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation. |
Medium | Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category. |
Low | Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score. |
Severity
- Critical
Description
- Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.
Severity
- High
Description
- High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.
Severity
- Medium
Description
- Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.
Severity
- Low
Description
- Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score.
Appendix 2. Scope
The scope of the project includes the following smart contracts from the provided repository:
Scope Details | |
|---|---|
| Functional Requirements | Provided |
| Technical Requirements | Provided |
Scope Details
- Functional Requirements
- Provided
- Technical Requirements
- Provided