Audit name:
[SCA] MetaTime | MetaChain | Oct2023
Date:
Nov 13, 2023
Table of Content
Introduction
We express our gratitude to the MetaTime team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.
By completely self-funding its technology development stages, Metatime aims to establish the world’s most comprehensive and transparent ecosystem. Metatime continues to innovate and develop a wide range of products such as MetaChain, MetaWallet, Metatime Coin, MetaExchange, and MetaNFT, placing user needs at the forefront and designing from the ground up.
| title | content |
|---|---|
| Platform | EVM |
| Language | Solidity |
| Tags | MetaChain |
| Timeline | 20/10/2023 - 12/11/2023 |
| Methodology | https://hackenio.cc/sc_methodology→ |
Review Scope | |
|---|---|
| Repository | https://github.com/Metatime-Technology-Inc/pool-contracts/→ |
| Commit | 73fc62c5410f868b6d2c24307be93d2401787221 |
Review Scope
- Commit
- 73fc62c5410f868b6d2c24307be93d2401787221
Audit Summary
10/10
100%
10/10
10/10
The system users should acknowledge all the risks summed up in the risks section of the report
Document Information
This report may contain confidential information about IT systems and the intellectual property of the Customer, as well as information about potential vulnerabilities and methods of their exploitation.
The report can be disclosed publicly after prior consent by another Party. Any subsequent publication of this report shall be without mandatory consent.
Document | |
|---|---|
| Name | Smart Contract Code Review and Security Analysis Report for MetaTime |
| Audited By | Hacken |
| Website | https://metatime.com/→ |
| Changelog | 27/10/2023 - Initial Review |
| 12/11/2023 - Second Review |
Document
- Name
- Smart Contract Code Review and Security Analysis Report for MetaTime
- Audited By
- Hacken
- Website
- https://metatime.com/→
- Changelog
- 27/10/2023 - Initial Review
- 12/11/2023 - Second Review
System Overview
MetaTime pools ... The files in the scope:
Distributor - This contract is designed to facilitate the distribution of coins over a specified period of time. It allows users to claim their share of coins based on the distribution rate and period length.
LiquidityPool - This contract is a smart contract used for managing a liquidity pool. It allows the owner to deposit coins into the pool and withdraw them as needed.
StrategicPool - This contract is designed for managing a strategic pool of coins. It allows the owner of the contract to burn coins from the pool using a formula or without using a formula.
TokenDistributor - This contract is a Solidity smart contract designed for distributing coins among users over a specific period of time. It allows the contract owner to set claimable amounts for users before the claim period starts and enables users to claim their coins during the distribution period. Any remaining coins after the claim period can be swept by the contract owner.
TokenDistributorWithNoVesting - The TokenDistributorWithNoVesting contract is designed for distributing coins during no vesting sales. It allows the contract owner to set claimable amounts for users and enables users to claim their coins within a specified claim period. Additionally, any remaining coins can be swept from the contract by the owner after the claim period ends.
Trigonometry - Library contract implemented for trigonometry calculations used in the burn with formula function.
PoolFactory - Contract that deploys Distributor and TokenDistributor contracts.
Privileged roles
The owner of each contract can set and change multiple configuration values and also access restricted functionalities.
Executive Summary
Documentation quality
The total Documentation quality score is 10 out of 10.
High level overview documentation has been created.
Technical descriptions have been provided and NatSpec is extensive.
Code quality
The total Code quality score is 10 out of 10.
The code is structured and readable.
The Gas model is optimized.
Test coverage
Code coverage of the project is 100% (branch coverage).
Deployment and some basic user interactions are covered with tests.
The extended code coverage was done after the security review
Security score
Upon auditing, the code was found to contain 0 critical, 0 high, 0 medium, and 1 low severity issues. Out of these, 1 issues have been addressed and resolved, leading to a Security score of 10 out of 10.
All identified issues are detailed in the “Findings” section of this report.
Summary
The comprehensive audit of the customer's smart contract yields an overall score of 10. This score reflects the combined evaluation of documentation, code quality, test coverage, and security aspects of the project.
Risks
The protocol is centralized and depends on a multisignature account to operate the reviewed contracts. Nevertheless, the MetaTime team heavily protects these accounts and always operates in the best interests of their community.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2023-0942 | Lack of parameter validation on Distributor initialization | fixed | Low | |
| I-2023-0249 | Centralization Risk | mitigated | Observation | |
| I-2023-0248 | Owner Can Renounce Itself | mitigated | Observation | |
| I-2023-0247 | Missing NatSpec documentation for leftClaimableAmount | fixed | Observation | |
| I-2023-0246 | Consider controlling casting overflow on StrategicPool | fixed | Observation | |
| I-2023-0245 | lastBurnedAmount of StrategicPool is redundant | fixed | Observation | |
| I-2023-0244 | Change return value to avoid extra SLOAD | fixed | Observation | |
| I-2023-0243 | PoolFactory implementation contracts can be set to zero or incorrect values leaving the contract non functional | fixed | Observation | |
| I-2023-0242 | Use two step ownership transfer pattern | fixed | Observation | |
| I-2023-0241 | Return value on _withdraw function of LiquidityPool contract not used | fixed | Observation |
Appendix 1. Severity Definitions
When auditing smart contracts, Hacken is using a risk-based approach that considers Likelihood, Impact, Exploitability and Complexity metrics to evaluate findings and score severities.
Reference on how risk scoring is done is available through the repository in our Github organization:
Severity | Description |
|---|---|
Critical | Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation. |
High | High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation. |
Medium | Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category. |
Low | Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score. |
Severity
- Critical
Description
- Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.
Severity
- High
Description
- High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.
Severity
- Medium
Description
- Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.
Severity
- Low
Description
- Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score.
Appendix 2. Scope
The scope of the project includes the following smart contracts from the provided repository:
Scope Details | |
|---|---|
| Repository | https://github.com/Metatime-Technology-Inc/pool-contracts/→ |
| Commit | 73fc62c5410f868b6d2c24307be93d2401787221 |
| Whitepaper | Provided→ |
| Requirements | Provided |
| Technical Requirements | Provided |
Scope Details
- Commit
- 73fc62c5410f868b6d2c24307be93d2401787221
- Whitepaper
- Provided→
- Requirements
- Provided
- Technical Requirements
- Provided