- Hacken
- Audits
- longdragon
- [SCA] War Chest | RewardPool | Apr2024
Audit name:
[SCA] War Chest | RewardPool | Apr2024
Date:
May 14, 2024
Table of Content
Introduction
We express our gratitude to the LongDragon team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.
LongDragon is a decentralized finance (DeFi) project that leverages blockchain technology to offer innovative staking and reward mechanisms for its native token, LD.
| title | content |
|---|---|
| Platform | EVM |
| Language | Solidity |
| Tags | Fungible Token; Staking; Centralization |
| Timeline | 17/04/2024 - 17/05/2024 |
| Methodology | https://hackenio.cc/sc_methodology→ |
Review Scope | |
|---|---|
| Repository | https://github.com/LongDragonNow/contracts→ |
| Commit | c31e4e4 |
Review Scope
- Commit
- c31e4e4
Audit Summary
10/10
99.06%
9/10
10/10
The system users should acknowledge all the risks summed up in the risks section of the report
Document Information
This report may contain confidential information about IT systems and the intellectual property of the Customer, as well as information about potential vulnerabilities and methods of their exploitation.
The report can be disclosed publicly after prior consent by another Party. Any subsequent publication of this report shall be without mandatory consent.
Document | |
|---|---|
| Name | Smart Contract Code Review and Security Analysis Report for LongDragon |
| Audited By | Ivan Bondar |
| Approved By | Grzegorz Trawinski |
| Website | https://longdragon.ai/→ |
| Changelog | 22/04/2024 - Preliminary Report |
| 17/05/2024 - Final Report |
Document
- Name
- Smart Contract Code Review and Security Analysis Report for LongDragon
- Audited By
- Ivan Bondar
- Approved By
- Grzegorz Trawinski
- Website
- https://longdragon.ai/→
- Changelog
- 22/04/2024 - Preliminary Report
- 17/05/2024 - Final Report
System Overview
LongDragon is a decentralized finance (DeFi) project that leverages blockchain technology to offer innovative staking and reward mechanisms for its native token, LD. Designed to integrate seamlessly with the Ethereum network and Uniswap V2. The system integrates three primary smart contracts: RewardPool, LdToken, and LdStaking. This system creates a comprehensive staking and reward distribution mechanism for the LD token, facilitating various functionalities such as liquidity management, reflections, and ecosystem development within a decentralized finance (DeFi) framework.
The files in the scope:
RewardPool.sol:
Manages the distribution of LD tokens as rewards from a designated pool.
Interacts with the LdStaking contract to send LD tokens to stakers.
Allows the owner to fund the pool and withdraw remaining tokens, aligning with the owner's control over the token flow.
LdToken.sol:
An ERC20 token with extended functionalities such as burnability, and permit features
Integrates with Uniswap V2 to create a pair for the token and to recognize the swap pair address .
Incorporates tax mechanisms for transactions, distributing taxes to liquidity pools, reflections, and ecosystem development wallets based on predefined percentages.
It has the following attributes:
Name: Long Dragon
Symbol: LD
Decimals: 18
Total supply: 200m tokens.
LdStaking.sol:
Facilitates staking of LD tokens, with features allowing users to stake, unstake, and claim rewards.
Utilizes RewardPool for handling rewards.
Contains mechanisms for withdrawal and reward restaking, enhancing user interaction and flexibility in managing their investments.
Privileged roles
RewardPool.sol:
Owner: Can fund the pool, withdraw tokens, and is the primary controller of the contract.
LdToken.sol:
Owner: Has extensive control over tokenomics, including tax rates, wallet exemptions, and anti-snipe mechanisms.
LdStaking.sol:
Owner: Manages staking parameters such as APR rates, staking status, and treasury addresses. The owner can open or close staking and claims, directly affecting user participation and reward distributions.
Executive Summary
Documentation quality
The total Documentation Quality score is 10 out of 10.
Functional requirements have some gaps.
Basic system description is provided.
All roles in the system are described.
Use cases are described.
Technical description is detailed.
Run instructions are provided.
Technical specification is provided.
The NatSpec documentation is sufficient.
Code quality
The total Code Quality score is 9 out of 10.
The development environment is configured.
Best practice violations.
Test coverage
Code coverage of the project is 99.06% (branch coverage).
Deployment and basic user interactions are covered with tests.
Negative cases coverage is present.
Security score
Upon auditing, the code was found to contain 4 critical, 2 high, 3 medium, and 3 low severity issues, leading to a security score of 0 out of 10. Upon retesting, 11 findings were resolved, and 1 was mitigated, leading to a security score of 10 out of 10.
All identified issues are detailed in the “Findings” section of this report.
Summary
The comprehensive audit of the customer's smart contract yields an overall score of 9.8. This score reflects the combined evaluation of documentation, code quality, test coverage, and security aspects of the project.
Risks
Centralized Minting to a Single Address: The project concentrates minting tokens in a single address, raising the risk of fund mismanagement or theft, especially if key storage security is compromised.
Owner's Unrestricted State Modification: The absence of restrictions on state variable modifications by the owner leads to arbitrary changes, affecting contract integrity and user trust, especially during critical operations like token withdrawal phases.
Insufficient Permissioning and Documentation: Inadequate permissions and under-documentation heighten the risk of unauthorized access and actions, complicating issue resolution and increasing the potential for security breaches.
Absence of Time-lock Mechanisms for Critical Operations: Without time-locks on critical operations, there is no buffer to review or revert potentially harmful actions, increasing the risk of rapid exploitation and irreversible changes.
Single Points of Failure and Control: The project is fully or partially centralized, introducing single points of failure and control. This centralization can lead to vulnerabilities in decision-making and operational processes, making the system more susceptible to targeted attacks or manipulation.
Administrative Key Control Risks: The digital contract architecture relies on administrative keys for critical operations. Centralized control over these keys presents a significant security risk, as compromise or misuse can lead to unauthorized actions or loss of funds.
Loss of Unclaimed Rewards on Unstaking: The unstakeLD function in the LdStaking.sol contract allows users to withdraw part or all of their staked LD tokens. However, the design of the unstaking mechanism paired with the rewards claim process introduces a risk of loss of unclaimed rewards. When a user unstakes without prior reward claims, any rewards accrued during the staking period are not automatically claimed or preserved. The claimOrUnstake window restricts unstaking to specific times, exacerbating potential losses if not strategically managed.
Unpredictable Changes to APR Rates: The changeApr function within the LdStaking.sol contract grants the owner unrestricted ability to adjust the Annual Percentage Rate (APR) for rewards on staked tokens. This function can be invoked at any time by the contract owner, altering the APR to any value above the defined minimum (100 basis points). Users staking their tokens with an expectation of stable returns may find the rewards significantly altered (increased or decreased) without prior notice.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2024-2714 | Excessive Reward Calculations Due to Flawed Compounding Logic | fixed | Critical | |
| F-2024-2703 | Flaw in reStake Function Leads to Incorrect Stake Amount Update | fixed | Critical | |
| F-2024-1440 | Exponential Reward Increase Due to Flawed Time-Based Calculation | fixed | Critical | |
| F-2024-1435 | Excessive Reward Distribution Due to Flawed Calculation | fixed | Critical | |
| F-2024-2704 | Imbalance in Token Allocation between LdStaking and RewardPool Contracts | fixed | High | |
| F-2024-1403 | Fund Lock Due to Incorrect Balance Reference in withdrawRemainingTokens | fixed | High | |
| F-2024-1441 | Loss of Access to User Funds Due to Pool Address Updates | mitigated | Medium | |
| F-2024-1419 | Denial of Service (DoS) via Out of Gas from High Staking Participant Count | fixed | Medium | |
| F-2024-1405 | Insecure Fund Management in LdStaking and RewardPool Contracts | fixed | Medium | |
| F-2024-1466 | Persistent checkUpkeep Triggering After 26 Weeks in Staking Contract | fixed | Low |
Appendix 1. Severity Definitions
When auditing smart contracts, Hacken is using a risk-based approach that considers Likelihood, Impact, Exploitability and Complexity metrics to evaluate findings and score severities.
Reference on how risk scoring is done is available through the repository in our Github organization:
Severity | Description |
|---|---|
Critical | Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation. |
High | High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation. |
Medium | Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category. |
Low | Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score. |
Severity
- Critical
Description
- Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.
Severity
- High
Description
- High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.
Severity
- Medium
Description
- Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.
Severity
- Low
Description
- Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score.
Appendix 2. Scope
The scope of the project includes the following smart contracts from the provided repository:
Scope Details | |
|---|---|
| Repository | https://github.com/LongDragonNow/contracts→ |
| Commit | c31e4e40f5949c7ac5e5eba2e26faaad0e71cacf |
| Whitepaper | N/A |
| Requirements | NatSpec |
| Technical Requirements | README.md |
Scope Details
- Commit
- c31e4e40f5949c7ac5e5eba2e26faaad0e71cacf
- Whitepaper
- N/A
- Requirements
- NatSpec
- Technical Requirements
- README.md