Kresus

We express our gratitude to the Kresus team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.

Kresus is a user-friendly crypto & Web3 wallet complete with total recoverability.

The system users should acknowledge all the risks summed up in the risks section of the report

Kresus Vault is a blockchain-based secure storage facility for digital assets like cryptocurrency, NFTs, and other tokens. The system consists from the following contracts:

• BaseModule — an abstract contract for a module, containing mainly internal view functions.

• Utils \- a library which contains helper methods dealing with signatures and function selectors.

• KresusModule \- a contract representing a module i.e. a vault of valuables.

• KresusRelayer \- an abstract contract with methods for executing transactions signed by accounts outside of Ethereum.

• SecurityManager \- an abstract contract dealing with security features of the KresusModule i.e. guardians, lock, recovery etc.

• TransactionManager \- an abstract contract for executing transactions in sequence or calling third-party contracts.

• Storage \- a contract containing methods on voting, setting locks and assigning guardians.

• Proxy \- a contract which delegated all calls to another fixed contract.

• Factory \- a contract which deploys new vaults against a set deployer, which can be changed.

Privileged roles

• The Module in Storage contract can set locks, toggle votings, add/revoke guardians, add/revoke heirs.

• The Deployer of the Factory contract can set a new deployer address and deploy a new vault.

• The KresusGuardian in the KresusModule contract can revoke guardian from a specific vault, lock or unlock vault. When voting is enabled - KresusGuardian signature is also required to  revoke guardian.

• The Guardian in the KresusModule contract can revoke guardian. During voting guardian signature is also required to enable ERC1155 token receiver, add new module, add new guardian, transfer vault ownership, revoke guardian, lock vault, perform multicall, toggle voting and set time delay.

• The Owner’s signature in the KresusModule can be necessary for certain types of transactions.

• The Module in the BaseVault can authorize modules, enable static calls, set an owner, or invoke a generic transaction.

The total Documentation quality score is 10 out of 10.

• No Whitepaper is provided.

• Functional and technical requirements are provided and well describe the project.

• The NatSpec comments are extensive.

The total Code quality score is 10 out of 10.

• The code is well structured with separation of concerns.

• The development environment is configured, though it requires manually setting environment variables from the developer.

Code coverage of the project is 98.94% (branch coverage).

• Deployment and basic user interactions are covered with tests.

• Only a few negative cases are covered.

• Interactions by several users are not tested thoroughly.

Upon auditing, the code was found to contain 0 critical, 7 high, 7 medium, and 36 low severity issues. Out of these, 44 issues have been addressed and resolved, leading to a Security score of 10 out of 10.

All identified issues are detailed in the “Findings” section of this report.

The comprehensive audit of the customer's smart contract yields an overall score of 9.9. This score reflects the combined evaluation of documentation, code quality, test coverage, and security aspects of the project.

The scope of the project includes the following smart contracts from the provided repository:

Contracts in Scope