MarsCat

We express our gratitude to the MarsCat team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.

MarsCat is a privacy-first social platform designed to operate natively on peer-to-peer networks, built upon the RelayX decentralized protocol. The system provides an ERC-20 utility token (MCAT), an ERC-20-based subscription recharge system, a points-based membership system, and a peer-to-peer red packet distribution mechanism. The core user-facing actions include purchasing time-bound membership subscriptions via token or points payments, claiming backend-authorized loyalty points, and sending or receiving token-backed red packets.

The system users should acknowledge all the risks summed up in the risks section of the report

Documentation quality

• Functional requirements are partially provided.

• Technical description are partially provided.

• NatSpec comments are missed for MarscatToken, MarscatPoints, and MarscatRedPacket.

Code quality

• The code leverages OpenZeppelin contracts and follows established patterns.

• The development environment is configured.

Test coverage

Code coverage of the Social-Contracts is 62.73% (branch coverage), Marscat-Token-Contracts is 77.27% (branch coverage), and Recharge-Contracts is 0%.

• Deployment and basic user interactions are covered with tests.

• Negative cases coverage is present.

• Interactions by several users are partially tested.

• Test cases for MarscatRecharge is missing.

The system is organized into three independently deployed sub-projects. The recharge and social contracts share a common security baseline of Ownable, ReentrancyGuard, and Pausable, while the token contract inherits ERC20, Ownable, and Pausable. The token sub-project contains MarscatToken, a fixed-supply ERC-20 with compliance controls. The recharge sub-project contains MarscatRecharge, which accepts ERC-20 payments for subscription purchases. The social sub-project contains MarscatPoints and MarscatRedPacket, which handle off-chain-authorized point distribution, points-based subscription recharge, and peer-to-peer gifting via red packets, respectively.

MarscatToken implements the ERC-20 standard with a fixed total supply of 1,000,000,000 MCAT minted at deployment. It enforces a blacklist mechanism at the transfer and approval level through overridden _update and _approve internals, and provides an owner-only transferBlackFunds function for seizing balances from blacklisted addresses. Ownership renunciation is explicitly disabled.

MarscatRecharge operates as a standalone subscription payment contract that maps configurable package IDs to per-token prices (via a nested packageId => token => amount mapping) and per-package durations. Users call recharge with a package ID, an ERC-20 token address, and a beneficiary address (restricted to EOAs), and the contract extends or initializes a time-bound subscription for that beneficiary. Accumulated token balances are withdrawn by the owner via withdrawToken.

MarscatPoints manages an off-chain-to-on-chain points ledger using EIP-712 typed signatures for authorized point claims. Points are non-transferable and exist only as internal balances. Users spend points through rechargeWithPoints to purchase membership subscriptions from owner-configured packages, with subscription durations that stack additively.

MarscatRedPacket enables users to escrow ERC-20 tokens or native BNB into single-claim red packets, each identified by a unique hash and protected by a temporary claim key. Recipients claim packets by providing a EIP-712 typed signature from the corresponding claim key. Unclaimed packets may be revoked by the original sender after a 24-hour lockup period. The two social contracts are independently deployed and do not interact with each other or with the token or recharge contracts on-chain.

Files in Scope

• MarscatToken.sol: An ERC-20 token contract that mints a fixed supply of 1,000,000,000 MCAT to a designated address at construction. It enforces blacklist checks on all transfers and approvals, provides owner-only functions for managing blacklisted addresses and seizing their funds via transferBlackFunds, and disables ownership renunciation by reverting in renounceOwnership.

• MarscatRecharge.sol: A subscription recharge contract that accepts ERC-20 token payments in exchange for time-bound memberships. Package pricing is configured per package ID and per token address via setPackagePrice, and durations are set per package via setPackageDuration. The recharge function transfers tokens from the caller and extends or initializes a subscription for a specified EOA beneficiary. The owner may withdraw accumulated tokens through withdrawToken.

• MarscatPoints.sol: A points ledger and membership subscription contract that allows users to claim off-chain-authorized points via claimPoints using EIP-712 signed messages verified against a configurable signer address. Claimed points are spent through rechargeWithPoints to purchase owner-configured subscription packages, with durations stacking on active subscriptions. Points balances are non-transferable and tracked internally.

• MarscatRedPacket.sol: A peer-to-peer red packet contract that allows users to escrow ERC-20 tokens via createRedPacket or native BNB via createNativeRedPacket, each secured by a temporary claim key. A recipient calls claimRedPacket with a signature from the claim key to withdraw the escrowed funds. The original sender may reclaim unclaimed packets after 24 hours through revokeRedPacket.

Privileged roles

MarscatRedPacket.sol:

• Owner (inherited from Ownable): Controls contract pausability. Assigned to msg.sender at deployment.

• • Can call pause to pause red packet creation and claiming.

  • Can call unpause to resume red packet creation and claiming.

  • Can call transferOwnership to transfer the owner role to a new address (inherited from Ownable).

  • Can call renounceOwnership to irrevocably renounce ownership, leaving the contract without an owner (inherited from Ownable).

MarscatPoints.sol:

• Owner (inherited from Ownable): Controls the trusted signer, subscription package configuration, and contract pausability. Assigned to msg.sender at deployment.

• • Can call setSigner to replace the trusted signer address used to authorize point claims.

  • Can call setPackagePrice to set or update the point cost of a subscription package.

  • Can call setPackageDuration to set or update the duration of a subscription package.

  • Can call removePackage to remove a subscription package by clearing its price and duration.

  • Can call pause to pause point claiming and subscription recharging.

  • Can call unpause to resume point claiming and subscription recharging.

  • Can call transferOwnership to transfer the owner role to a new address (inherited from Ownable).

  • Can call renounceOwnership to irrevocably renounce ownership (inherited from Ownable).

• Signer: Off-chain trusted address stored in the signer state variable. Set via the constructor and updatable by the Owner via setSigner.

• • Signatures from this address are required to authorize claimPoints calls, effectively controlling which users may claim points and in what amounts.

MarscatRecharge.sol:

• Owner (inherited from Ownable): Controls package configuration, token withdrawals, and contract pausability. Assigned to msg.sender at deployment.

• • Can call setPackagePrice to set the token address and amount required for a subscription package.

  • Can call setPackageDuration to set or update the duration of a subscription package.

  • Can call withdrawToken to withdraw any ERC-20 tokens held by the contract to a specified recipient address.

  • Can call pause to pause subscription recharging.

  • Can call unpause to resume subscription recharging.

  • Can call transferOwnership to transfer the owner role to a new address (inherited from Ownable).

  • Can call renounceOwnership to irrevocably renounce ownership (inherited from Ownable).

MarscatToken.sol:

• Owner (inherited from Ownable): Controls token pausability, blacklist management, and forced fund transfers. Assigned to the mintTo_ address at deployment, which also receives the entire fixed supply.

• • Can call pause to pause all token transfers and approvals.

  • Can call unpause to resume all token transfers and approvals.

  • Can call addBlacklist to add addresses to the blacklist, preventing them from sending, receiving, or approving tokens.

  • Can call removeBlacklist to remove addresses from the blacklist, restoring their ability to transact.

  • Can call transferBlackFunds to forcibly transfer the entire token balance of one or more blacklisted addresses to a specified non-blacklisted recipient.

  • Can call transferOwnership to transfer the owner role to a new address. The new owner must not be blacklisted.

  • Ownership renunciation is disabled; calling renounceOwnership always reverts with RenounceNotAllowed.

The scope of the project includes the following smart contracts from the provided repository:

Assets in Scope