- Hacken
- Audits
- kronos-investimentos-ltda-exoworld
- [SCA] Kronos Investments | ERC20 + Staking + Bridge | Feb2023
Audit name:
[SCA] Kronos Investments | ERC20 + Staking + Bridge | Feb2023
Date:
Feb 11, 2023
Table of Content
Introduction
We express our gratitude to the Kronos Investimentos LTDA (ExoWorld) team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.
Kronos Investimentos is a system that includes 2 different ERC20 tokens; EXO token, GCred token. EXO tokens can be used for staking and voting; as a staking reward, users get GCred tokens + EXO tokens. GCred tokens can be used for buying an item.
| title | content |
|---|---|
| Platform | Ethereum, BNB Chain |
| Language | Solidity |
| Tags | ERC20 token, Staking, Voting, Bridge |
| Timeline | 30/08/2022 - 10/02/2023 |
| Methodology | https://hackenio.cc/sc_methodology→ |
Review Scope | |
|---|---|
| Repository | https://bitbucket.org/exoworldsnft/exotoken/src/master/→ |
| Commit | df63d15910a706b68322839fc2d4d57c69f959a3 |
Review Scope
- Commit
- df63d15910a706b68322839fc2d4d57c69f959a3
Audit Summary
10/10
97.47%
9/10
8/10
The system users should acknowledge all the risks summed up in the risks section of the report
Document Information
This report may contain confidential information about IT systems and the intellectual property of the Customer, as well as information about potential vulnerabilities and methods of their exploitation.
The report can be disclosed publicly after prior consent by another Party. Any subsequent publication of this report shall be without mandatory consent.
Document | |
|---|---|
| Name | Smart Contract Code Review and Security Analysis Report for Kronos Investimentos LTDA (ExoWorld) |
| Audited By | Hacken |
| Changelog | 06/09/2022 – Initial Review |
| 12/10/2022 – Second Review | |
| 23/11/2022 – Third Review | |
| 05/01/2023 – Fourth Review | |
| 17/01/2023 – Fifth Review | |
| 23/01/2023 – Sixth Review | |
| 10/02/2023 – Seventh Review |
Document
- Name
- Smart Contract Code Review and Security Analysis Report for Kronos Investimentos LTDA (ExoWorld)
- Audited By
- Hacken
- Changelog
- 06/09/2022 – Initial Review
- 12/10/2022 – Second Review
- 23/11/2022 – Third Review
- 05/01/2023 – Fourth Review
- 17/01/2023 – Fifth Review
- 23/01/2023 – Sixth Review
- 10/02/2023 – Seventh Review
System Overview
Kronos Investimentos is a system that includes 2 different ERC20 tokens; EXO token, GCred token. EXO tokens can be used for staking and voting; as a staking reward, users get GCred tokens + EXO tokens. GCred tokens can be used for buying an item.
Bridge - a simple contract that builds a bridge and allows to mint/burn tokens.
EXOToken - an upgradable and pausable ERC20 token contract with different functionalities. It has the following attributes: \-Name: ExoToken. \-Symbol: EXO. \-Decimals: 18. \-Total supply: 10 billion.
IExoToken - interface of ExoToken contract.
Migrations - a contract stores the number of the last deployment script applied.
ProxyAdmin \- the exact same contract of OpenZeppelin ProxyAdmin.
TransparentUpgradeableProxy - a proxy contract with a built-in admin and upgrade interface. The contract is from OpenZeppelin library.
GCREDToken \- an upgradable ERC20 contract that allows users to buy items in exchange for GCred tokens. \-Name: ExoToken. \-Symbol: EXO. \-Decimals: 18. Total supply: not capped.
Governance - an upgradable contract that manages a voting system. Having one unit of EXO token is enough to vote for a proposal.
StakingReward - staking contract that allows users to stake their EXO tokens. As a reward, both EXO and GCRED tokens are distributed.
Privileged roles
The owner of the ExoToken, TokenEth, and TokenVe contract can:
pause/unpause the contract.
update the bridge address.
update the GCred token address.
update the FNWallet address.
mint EXO tokens.
can distribute users’ staked tokens and rewards.
create a new subject for voting.
The admin of the Bridge contract can:
mint EXO tokens.
The owner of the GCred contract can:
pause/unpause the contract.
update the EXO token address.
set MDWallet and DAOWallet addresses.
mint GCred tokens.
Executive Summary
Documentation quality
The total Documentation quality score is 8 out of 10.
Tokenomics and some functional requirements were provided.
Technical description for running the development environment is provided.
NatSpec format was followed.
A public whitepaper is provided but it includes some spelling and alignment mistakes.
Code quality
The total Code quality score is 9 out of 10.
Code conforms to the style guide rules and does not include any redundant declaration.
StakingReward contract has low readability due to use of lots of variables.
Test coverage
Code coverage of the project is 97.47% (branch coverage).
Unit tests are running properly.
Security score
Upon auditing, the code was found to contain 7 critical, 9 high, 4 medium, and 25 low severity issues. Out of these, 43 issues have been addressed and resolved, leading to a security score of 10 out of 10.
All identified issues are detailed in the “Findings” section of this report.
Summary
The comprehensive audit of the customer's smart contract yields an overall score of 9.5. This score reflects the combined evaluation of documentation, code quality, test coverage, and security aspects of the project.
Risks
Bridge contracts are secure; however, bridge protocol is centralized, and secureness relies on the backend server. The security of the protocol cannot be guaranteed.
The owner can burn EXO tokens from any address without permission.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2023-112 | Data Inconsistency | fixed | Critical | |
| F-2023-1124 | Possible Denial of Service | fixed | Critical | |
| F-2023-1123 | Data Consistency | fixed | Critical | |
| F-2023-112 | Possible Denial of Service | fixed | Critical | |
| F-2023-1121 | Users Cannot Withdraw All Funds | fixed | Critical | |
| F-2023-1120 | Invalid Calculations | fixed | Critical | |
| F-2023-1119 | Token Supply Manipulation | fixed | Critical | |
| F-2023-113 | Requirements Violation | fixed | High | |
| F-2023-1133 | Data Consistency | fixed | High | |
| F-2023-1132 | Unoptimized Getter Functions | fixed | High |
Appendix 1. Severity Definitions
When auditing smart contracts, Hacken is using a risk-based approach that considers Likelihood, Impact, Exploitability and Complexity metrics to evaluate findings and score severities.
Reference on how risk scoring is done is available through the repository in our Github organization:
Severity | Description |
|---|---|
Critical | Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation. |
High | High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation. |
Medium | Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category. |
Low | Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score. |
Severity
- Critical
Description
- Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.
Severity
- High
Description
- High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.
Severity
- Medium
Description
- Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.
Severity
- Low
Description
- Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score.
Appendix 2. Scope
The scope of the project includes the following smart contracts from the provided repository:
Scope Details | |
|---|---|
| Repository | https://bitbucket.org/exoworldsnft/exotoken/src/master/→ |
| Commit | df63d15910a706b68322839fc2d4d57c69f959a3 |
| Whitepaper | Not provided |
| Requirements | Provided |
| Technical Requirements | Provided |
Scope Details
- Commit
- df63d15910a706b68322839fc2d4d57c69f959a3
- Whitepaper
- Not provided
- Requirements
- Provided
- Technical Requirements
- Provided