Q2 2026 Security & Compliance Report67 incidents, $764M in losses, 88% from operational failures.
Get the report →
KYOTO logo

KYOTO

Audit name:

[SCA] Kyoto Protocol | Chain-Contracts | Apr2024

Date:

Apr 26, 2024

Table of Content

→Introduction
→Audit Summary
→Document Information
→System Overview
→Executive Summary
→Risks
→Findings
→Appendix 1. Severity Definitions
→Appendix 2. Scope
→Disclaimer

Want a comprehensive audit report like this?

Introduction

We express our gratitude to the KYOTO team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.

KyotoProtocol is a carbon-negative blockchain designed to scale the Voluntary Carbon Market (VCM) and foster the growth of Regenerative Finance (ReFi) by leveraging Web3 technologies.

titlecontent
PlatformEVM
LanguageSolidity
TagsStaking, Vesting
Timeline09/04/2024 - 16/04/2024
Methodologyhttps://hackenio.cc/sc_methodology→

    Review Scope

    Repositoryhttps://github.com/KyotoCarbonCo/chain-contracts→
    Commit40b3c32

    Audit Summary

    Total10/10
    Security Score

    10/10

    Test Coverage

    100%

    Code Quality Score

    10/10

    Documentation Quality Score

    10/10

    7Total Findings
    6Resolved
    0Accepted
    1Mitigated

    The system users should acknowledge all the risks summed up in the risks section of the report

    Document Information

    This report may contain confidential information about IT systems and the intellectual property of the Customer, as well as information about potential vulnerabilities and methods of their exploitation.

    The report can be disclosed publicly after prior consent by another Party. Any subsequent publication of this report shall be without mandatory consent.

    Document

    NameSmart Contract Code Review and Security Analysis Report for KYOTO
    Audited ByNiccolò Pozzolini
    Approved ByPrzemyslaw Swiatowiec
    Websitehttps://kyotoprotocol.io→
    Changelog11/04/2024 - Preliminary Report; 16/04/2024 - Remediation Report

    • Document

      Name
      Smart Contract Code Review and Security Analysis Report for KYOTO
      Audited By
      Niccolò Pozzolini
      Approved By
      Przemyslaw Swiatowiec
      Website
      https://kyotoprotocol.io→
      Changelog
      11/04/2024 - Preliminary Report; 16/04/2024 - Remediation Report

    System Overview

    The scope is composed by the chain contracts of the project KyotoProtocol:

    • KyotoVault: Simple Vault contract that allows withdrawing funds by authorized addresses

    • KyotoVesting: contract used to prevent migrated funds from flooding Kyoto Network with liquidity. After migration, tokens are put in the vesting contract and released accordingly to the vesting schedule - linearly each day over 18 months.

    • MigrationStorage:  contract used to handle the migration process for transferring funds to a vesting contract making sure that the same migration isn't processed twice.

    • NodeNFTRegistry: an ERC721 NFT collection contract, used to represent ownership of Kyoto Network Nodes.

    • NodeNFTStaking: staking contract for NFTs. Users can stake their NFTs in the contract and receive Kyoto in exchange at a fixed rate. It can be unstaked at any time with no penalties.

    • RewardsCollector:  contract that can receive Kyoto and distribute it to a configured set of targets with different weights.

    • StakingPool: staking contract for Kyoto, with limits on how much can be staked at any time.

    • ValidatorManager: contract that manages the validators of Kyoto Chain.

    Privileged roles

    • KyotoVault

      • DEFAULTADMINROLE: can manage roles

      • WITHDRAWER_ROLE: can withdraw funds

    • KyotoVesting

      • DEFAULTADMINROLE: can manage roles

      • MIGRATOR_ROLE: can create new vesting schedules

    • MigrationStorage

      • MIGRATOR_ROLE: can start the migration process

    • NodeNFTRegistry

      • DEFAULTADMINROLE: can manage roles and act as NODEMANAGERROLE

      • NODEMANAGERROLE: can mint new NFTs and change URI config

    • NodeNFTStaking

      • DEFAULTADMINROLE : can manage roles

      • MANAGER_ROLE: can change NFT collection that can be staked in the contract

    • RewardsCollector

      • DEFAULTADMINROLE: can update targets and percentages

    • StakingPool

      • DEFAULTADMINROLE: can manage roles

      • MANAGER_ROLE: can change financial parameters of the contract

    • ValidatorManager

      • owner: can update the validators set

    Executive Summary

    Documentation quality

    The total Documentation Quality score is 10 out of 10.

    • Functional requirements are complete.

    • Technical description is provided.

    Code quality

    The total Code Quality score is 10 out of 10.

    • The development environment is configured.

    Test coverage

    Code coverage of the project is 100% (branch coverage).

    • Deployment and basic user interactions are covered with tests.

    • Negative cases are covered.

    • Interactions by several users are tested thoroughly.

    Security score

    Upon auditing, the code was found to contain 0 critical, 1 high, 0 medium, and 2 low severity issues, leading to a security score of 10 out of 10.

    All identified issues are detailed in the “Findings” section of this report.

    Summary

    The comprehensive audit of the customer's smart contract yields an overall score of 10. This score reflects the combined evaluation of documentation, code quality, test coverage, and security aspects of the project.

    Scoring Methodologyarrow right

    Risks

    Dependency on Unaudited External Libraries: The project utilizes libraries or contracts without security audits, potentially introducing vulnerabilities. This compromises the security of the audited system, making it susceptible to attacks exploiting these external weaknesses. Libray used: PRBMath.

    Findings

    F-2024-2099Faulty rewards accountancy logic in staking contract
    Status
    fixed
    Severity

    High
    F-2024-2102Missed pull over push pattern in RewardsCollector
    Status
    mitigated
    Severity

    Low
    F-2024-2100Potential locking of staked NFTs due to changeable NFT address
    Status
    fixed
    Severity

    Low
    F-2024-2104Lack of Parameter Validation in setValidators Function
    Status
    fixed
    Severity

    Observation
    F-2024-2103Hardcoded APY in _rewardsPerTick function
    Status
    fixed
    Severity

    Observation
    F-2024-2101Redundant math in stake function
    Status
    fixed
    Severity

    Observation
    F-2024-2098Redundant assignment in MigrationStorage's constructor
    Status
    fixed
    Severity

    Observation
    Code
    ―
    Title
    Status
    Severity
    F-2024-2099Faulty rewards accountancy logic in staking contract
    fixed

    High
    F-2024-2102Missed pull over push pattern in RewardsCollector
    mitigated

    Low
    F-2024-2100Potential locking of staked NFTs due to changeable NFT address
    fixed

    Low
    F-2024-2104Lack of Parameter Validation in setValidators Function
    fixed

    Observation
    F-2024-2103Hardcoded APY in _rewardsPerTick function
    fixed

    Observation
    F-2024-2101Redundant math in stake function
    fixed

    Observation
    F-2024-2098Redundant assignment in MigrationStorage's constructor
    fixed

    Observation
    1-7 of 7 findings

    Identify vulnerabilities in your smart contracts.

    Appendix 1. Severity Definitions

    When auditing smart contracts, Hacken is using a risk-based approach that considers Likelihood, Impact, Exploitability and Complexity metrics to evaluate findings and score severities.

    Reference on how risk scoring is done is available through the repository in our Github organization:

    Severity

    Description

    Critical
    		Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.

    High
    		High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.

    Medium
    		Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.

    Low
    		Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score.

    • Severity

      Critical

      Description

      Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.

      Severity

      High

      Description

      High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.

      Severity

      Medium

      Description

      Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.

      Severity

      Low

      Description

      Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score.

    Appendix 2. Scope

    The scope of the project includes the following smart contracts from the provided repository:

    Scope Details

    Repositoryhttps://github.com/KyotoCarbonCo/chain-contracts→
    Commit40b3c3292e7bccf8cc04c0608dbe224e75a83789
    Requirementskyoto-flows.pdf
    Technical Requirementskyoto-flows.pdf, readme.md

    Contracts in Scope

    src
    KyotoVault.sol - src › KyotoVault.sol
    KyotoVesting.sol - src › KyotoVesting.sol
    MigrationStorage.sol - src › MigrationStorage.sol
    NodeNFTRegistry.sol - src › NodeNFTRegistry.sol
    NodeNFTStaking.sol - src › NodeNFTStaking.sol
    RewardsCollector.sol - src › RewardsCollector.sol
    StakingPool.sol - src › StakingPool.sol
    ValidatorManager.sol - src › ValidatorManager.sol
    interfaces
    IKyotoVault.sol - src › interfaces › IKyotoVault.sol
    IKyotoVesting.sol - src › interfaces › IKyotoVesting.sol
    IRewardsCollector.sol - src › interfaces › IRewardsCollector.sol
    ValidatorSmartContractInterface.sol - src › interfaces › ValidatorSmartContractInterface.sol
    libs
    Errors.sol - src › libs › Errors.sol

    Disclaimer