- Hacken
- Audits
- merlin-protocol
- [SCA] Merlin Protocol | DAO | Mar2024
Introduction
We express our gratitude to the Merlin Protocol team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.
The Merlin protocol is a leading DeFi solution, integrating advanced blockchain tech with sophisticated investment strategies. It offers decentralized governance, admin tools, token allocation control, and automated rebalancing for dynamic adaptation to market conditions and investment goals
Document | |
|---|---|
| Name | Smart Contract Code Review and Security Analysis Report for Merlin Protocol |
| Audited By | Seher Saylik |
| Approved By | Ataberk Yavuzer |
| Website | https://merlinprotocol.io/→ |
| Changelog | 02/04/2024 - Preliminary Report (Initial Version) |
| 29/04/2024 - Final Report (Initial Version) | |
| 10/07/2024 - Secondary Report (New Structural Changes) | |
| 24/07/2024 - Final Report (Secondary Version) | |
| Platform | EVM |
| Language | Solidity |
| Tags | AMM |
| Methodology | https://hackenio.cc/sc_methodology→ |
Document
- Name
- Smart Contract Code Review and Security Analysis Report for Merlin Protocol
- Audited By
- Seher Saylik
- Approved By
- Ataberk Yavuzer
- Website
- https://merlinprotocol.io/→
- Changelog
- 02/04/2024 - Preliminary Report (Initial Version)
- 29/04/2024 - Final Report (Initial Version)
- 10/07/2024 - Secondary Report (New Structural Changes)
- 24/07/2024 - Final Report (Secondary Version)
- Platform
- EVM
- Language
- Solidity
- Tags
- AMM
- Methodology
- https://hackenio.cc/sc_methodology→
Review Scope | |
|---|---|
| Repository | https://github.com/MerlinProtocol-Dev/merlin-protocol→ |
| Commit | fd58e4f |
Review Scope
- Commit
- fd58e4f
Audit Summary
The system users should acknowledge all the risks summed up in the risks section of the report
Documentation quality
Functional requirements are partially missed.
The technical requirements are provided.
NatSpec is provided.
Code quality
Some best practices were violated.
The naming conventions can be improved
The development environment is configured.
Test coverage
Code coverage of the project is 0% (branch coverage).
All of the tests provided were commented out.
System Overview
Merlin Protocol is a decentralized market that provides several features like decentralized governance, administrative management of the fund, token allocation control, and an automatic rebalancing process with the following contracts:
Lock — a simple lock mechanism that enables an owner to lock funds until a specified future time. After this time has passed, the owner can withdraw the funds.
MerlinERC20 — an ERC20 token contract that mints all the supply to msg.sender.
It has the following attributes:
Name: Merlin
Symbol: MRN
Decimals: 18
Total supply: 50.000.000
MerlinFaucet — is designed to distribute free tokens on a testnet for testing purposes. Users can request tokens from the faucet contract by calling the faucet() function.
MerlinFund — an ERC20 token contract with advanced fund management features. Users can deposit funds to receive Merlin Fund tokens, request withdrawals, and claim pending withdrawals. The contract maintains a basket of funds and periodically rebalances it based on withdrawal requests and market conditions. Fees are applied to deposits, and price calculations are performed to ensure accurate asset valuations. Overall, the contract facilitates decentralized fund management and asset allocation.
The price of Merlin Fund token is calculated based on the following formula:
Price of Merlin Fund token = (Total USD value of all different funds in the basket/platform + USDC balance of the contract) / total supply of Merlin Fund tokens
MerlinFundAdministrative — an admin contract that extends administrative functionalities for the Merlin Fund protocol. It allows setting addresses, managing whitelists, configuring fees, and facilitating ownership transfers.
MerlinFundModifier — a contract serves as the modifier storage of platform, defining key roles and restrictions. It manages access control for administrators, swap managers, and fee managers, while also enforcing conditions such as ensuring the fund's percentage allocation equals 100% and preventing swap processes from occurring simultaneously.
MerlinGovernor — a governance contract implements a governance system for the Merlin protocol, integrating various features such as voting, proposal execution, and timelock control. It extends several predefined contracts from the OpenZeppelin library to establish governance functionalities, including vote counting, quorum calculation, and timelock management.
RebalanceController — a contract that manages the automated rebalancing of token allocations within the Merlin protocol. It ensures timely rebalancing intervals, calculates token amounts for swaps 6 based on preset percentages, and executes swaps between different assets using external swap routers. This process helps maintain the desired portfolio composition within the protocol.
SwapController — a contract that facilitates token swaps within the Merlin protocol using Uniswap V3 routers. It includes functions to execute token swaps based on specified input parameters, such as token addresses and amounts.
TimeLock — is an implementation of a timelock mechanism using OpenZeppelin's TimelockController. It allows for the scheduling of transactions that can only be executed after a specified delay period, as set by the minDelay parameter.
TokenAllocationController — a contract that manages token allocations within a fund. It allows adding tokens, setting their percentages, adjusting percentages, and discarding tokens. Key features include adding tokens with associated addresses, adjusting percentages, and discarding tokens based on their current price.
Privileged roles
The owner of the Lock contract can withdraw the contract balance when the lock period is over.
The owner of MerlinFund contract can set the admin, add a new owner and transfer ownership.
The admin of MerlinFund contract can set the swap manager address, set the USDC address, set swap internal durations, set protocol fee, add funds to platform, set aggregator and router addresses of funds, specify percentages of system funds, discard funds from the contract and, set fee manager address.
The fee manager of MerlinFund contract can claim the accumulated protocol fees.
The swap manager of Merlin Fund contract can execute the swap operation to rebalance the funds.
Risks
Assuming a default of 18 decimal places for tokens lacking explicit decimal values can lead to price miscalculations, particularly for tokens without decimal precision, posing a significant risk within the system.
Administrative Key Control Risks: The digital contract architecture relies on administrative keys for critical operations. Centralized control over these keys presents a significant security risk, as compromise or misuse can lead to unauthorized actions or loss of funds.
All test cases were commented out in the latest commit hash.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2024-4205 | Exhaustion Attack In Sale Demand May Lead To Incorrect basketRequestsSum Value | fixed | High | |
| F-2024-1751 | changePercentage() Function Swaps Incorrect Amount | fixed | High | |
| F-2024-1896 | Fee Manager Can Withdraw Infinitive Fee From the Contract | fixed | High | |
| F-2024-4445 | Incorrect Token Swapping Due to Faulty swapCounter Reset Logic in resetSwapCounter() Function | fixed | Medium | |
| F-2024-4206 | Partial Withdrawal Lock | fixed | Medium | |
| F-2024-4154 | Incorrect Comparison Between Token Amount and USDT Value in closeBasket() Function | fixed | Medium | |
| F-2024-1900 | Incorrect Token Swapping in the swap() Function | fixed | Medium | |
| F-2024-1898 | Chainlink’s latestRoundData() Might Return Stale or Incorrect Results | fixed | Medium | |
| F-2024-1895 | Fees Are Not Restricted And They Can Be Frontrunned | fixed | Medium | |
| F-2024-1893 | Missing Slippage Check | fixed | Medium |
Appendix 1. Severity Definitions
When auditing smart contracts, Hacken is using a risk-based approach that considers Likelihood, Impact, Exploitability and Complexity metrics to evaluate findings and score severities.
Reference on how risk scoring is done is available through the repository in our Github organization:
Severity | Description |
|---|---|
Critical | Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation. |
High | High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation. |
Medium | Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category. |
Low | Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score. |
Severity
- Critical
Description
- Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.
Severity
- High
Description
- High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.
Severity
- Medium
Description
- Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.
Severity
- Low
Description
- Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score.
Appendix 2. Scope
The scope of the project includes the following smart contracts from the provided repository:
Scope Details | |
|---|---|
| Repository | https://github.com/MerlinProtocol-Dev/merlin-protocol→ |
| Commit | fd58e4f |
| Whitepaper | N/A |
| Requirements | N/A |
| Technical Requirements | N/A |
Scope Details
- Commit
- fd58e4f
- Whitepaper
- N/A
- Requirements
- N/A
- Technical Requirements
- N/A