Audit name:
[SCA] MetaTime | Layer 2 | Oct2023
Date:
Nov 7, 2023
Table of Content
Introduction
We express our gratitude to the MetaTime team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.
By completely self-funding its technology development stages, Metatime aims to establish the world’s most comprehensive and transparent ecosystem. Metatime continues to innovate and develop a wide range of products such as MetaChain, MetaWallet, Metatime Coin, MetaExchange, and MetaNFT, placing user needs at the forefront and designing from the ground up.
| title | content |
|---|---|
| Platform | EVM |
| Language | Solidity |
| Tags | Layer 2, Proof of Stake, Yield |
| Timeline | 20/10/2023 - 07/11/2023 |
| Methodology | https://hackenio.cc/sc_methodology→ |
Review Scope | |
|---|---|
| Repository | https://github.com/Metatime-Technology-Inc/genesis-contracts→ |
| Commit | 8cd0c6667bd4c42f6554d2ae0aa8d4daa8ea998e |
Review Scope
- Commit
- 8cd0c6667bd4c42f6554d2ae0aa8d4daa8ea998e
Audit Summary
10/10
100%
10/10
10/10
The system users should acknowledge all the risks summed up in the risks section of the report
Document Information
This report may contain confidential information about IT systems and the intellectual property of the Customer, as well as information about potential vulnerabilities and methods of their exploitation.
The report can be disclosed publicly after prior consent by another Party. Any subsequent publication of this report shall be without mandatory consent.
Document | |
|---|---|
| Name | Smart Contract Code Review and Security Analysis Report for MetaTime |
| Audited By | Ataberk Yavuzer - Senior Solidity SC Auditor at Hacken OÜ |
| Approved By | Luciano Ciattaglia - Head of Services |
| Grzegorz Trawiński - Lead Solidity SC Auditor at Hacken OÜ | |
| Website | https://metatime.com/→ |
| Changelog | 26/10/2023 - Initial Review |
| 07/11/2023 - Second Review |
Document
- Name
- Smart Contract Code Review and Security Analysis Report for MetaTime
- Audited By
- Ataberk Yavuzer - Senior Solidity SC Auditor at Hacken OÜ
- Approved By
- Luciano Ciattaglia - Head of Services
- Grzegorz Trawiński - Lead Solidity SC Auditor at Hacken OÜ
- Website
- https://metatime.com/→
- Changelog
- 26/10/2023 - Initial Review
- 07/11/2023 - Second Review
System Overview
MetaTime is a Layer 1 protocol with the following contracts:
BlockValidator — a contract for validating and finalizing blocks.
Bridge — a smart contract for bridging tokens to another chain.
Macrominer — a contract for managing and voting on the status of macrominers which is one of the main types of nodes in the protocol.
Metaminer — a smart contract representing a Metaminer which is one of the main types of nodes, allowing users to stake and participate in block validation.
Microminer — a smart contract to manage Microminer nodes on the protocol which is another miner type to participate in votes.
MinerFormula — a smart contract for managing reward calculation formulas for miners.
MinerHealthCheck — a contract for checking and managing miner health status.
MinerList — a smart contract for managing a list of miners.
TxValidator — a contract for validating transactions and managing votes on transactions.
MinerPool — contract which manages the distribution of tokens to miners based on their activity. This contract interacts with MinerHealthCheck and TxValidator contracts for rewards.
RewardsPool — a smart contract for distributing tokens over a specified period of time for mining purposes. This contract interacts with the BlockValidator contract for rewards.
Privileged roles
The protocol owner (OWNERROLE) can modify blacklist users and freeze Bridge contracts, enroll Metaminer_ nodes, extend their subscriptions, set share percentage information for miners, and change timeout for miner nodes.
Validators (VALIDATOR_ROLE) can add a block payload to the queue for a specific block.
Managers (MANAGERROLE) are responsible for making calls from other contracts in the protocol. The MANAGERROLE will be granted to smart contracts by protocol owners.
Executive Summary
Documentation quality
The total Documentation quality score is 10 out of 10.
Functional requirements are provided.
Business logic is provided.
Use cases are provided very detailed.
Technical description is provided.
Code quality
The total Code quality score is 10 out of 10.
The development environment is configured.
The code follows the Solidity Style Guide.
The code is optimized from a gas consumption perspective.
Test coverage
Code coverage of the project is 100% (branch coverage).
Deployment and basic user interactions are covered with tests.
All protocol features and cases are covered with tests.
Security score
Upon auditing, the code was found to contain 3 critical, 3 high, 5 medium, and 6 low severity issues. Out of these, 17 issues have been addressed and resolved, leading to a Security score of 10 out of 10.
All identified issues are detailed in the “Findings” section of this report.
Summary
The comprehensive audit of the customer's smart contract yields an overall score of 10. This score reflects the combined evaluation of documentation, code quality, test coverage, and security aspects of the project.
Risks
Validators have full authority on block payloads. Therefore, they can craft malicious block payloads by setting high txRewards.
If MANAGERROLE accidentally grants any EOA address by the owner, that user can drain all balance on MinerPool, RewardsPool, BlockValidator, MainnetBridge, Bridge, MainnetBridge_ contracts since these contracts have ether sending functions. Additionally, it is possible to mint unlimited MetaPoints with the same permission.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2023-0927 | Vote functionality in TxValidator is open to manipulation | fixed | Critical | |
| F-2023-0926 | Over-rewarding users due to inconsistency on MinerFormulas | fixed | Critical | |
| F-2023-0925 | Drain of funds by calling unsubscribe() function due to reentrancy | fixed | Critical | |
| F-2023-0930 | Macrominers can cast unlimited votes to kick inactive miners | fixed | High | |
| F-2023-0929 | Unpaid validators can getting paid and deny unsubscribe() right of paid validators | fixed | High | |
| F-2023-0928 | Macrominer nodes can gain full authority over reward decisions in short period | fixed | High | |
| F-2023-0935 | Share incomes may not be distributed due to incorrect allocation | fixed | Medium | |
| F-2023-0934 | Macrominer nodes can gain full authority over kicking inactive nodes in short period | fixed | Medium | |
| F-2023-0933 | Malicious validator can drain all Metaminer funds via Reentrancy on _shareIncome() function | fixed | Medium | |
| F-2023-0932 | Shareholder incomes set by admin can be eliminated by paying ANNUAL_AMOUNT | fixed | Medium |
Appendix 1. Severity Definitions
When auditing smart contracts, Hacken is using a risk-based approach that considers Likelihood, Impact, Exploitability and Complexity metrics to evaluate findings and score severities.
Reference on how risk scoring is done is available through the repository in our Github organization:
Severity | Description |
|---|---|
Critical | Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation. |
High | High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation. |
Medium | Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category. |
Low | Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score. |
Severity
- Critical
Description
- Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.
Severity
- High
Description
- High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.
Severity
- Medium
Description
- Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.
Severity
- Low
Description
- Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score.
Appendix 2. Scope
The scope of the project includes the following smart contracts from the provided repository:
Scope Details | |
|---|---|
| Repository | https://github.com/Metatime-Technology-Inc/genesis-contracts→ |
| Commit | 8cd0c6667bd4c42f6554d2ae0aa8d4daa8ea998e |
| Whitepaper | Provided→ |
| Requirements | Provided |
| Technical Requirements | Provided |
Scope Details
- Commit
- 8cd0c6667bd4c42f6554d2ae0aa8d4daa8ea998e
- Whitepaper
- Provided→
- Requirements
- Provided
- Technical Requirements
- Provided