Q1 2025 Web3 Security ReportAccess control failures led to $1.63 billion in losses
Discover report insights
  • Hacken
  • Audits
  • metis
  • [SCA] Metis / ERC20 / Oct2022
Metis logo

Metis

Audit name:

[SCA] Metis / ERC20 / Oct2022

Date:

Oct 6, 2022

Table of Content

→Introduction
→Audit Summary
→Document Information
→System Overview
→Executive Summary
→Risks
→Findings
→Appendix 1. Severity Definitions
→Appendix 2. Scope
→Disclaimer

Want a comprehensive audit report like this?

Introduction

We express our gratitude to the Metis team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.

Metis is a permissionless Layer 2 network powering the next generation of decentralized applications.

titlecontent
PlatformEthereum, BNB Chain
LanguageSolidity
TagsStaking, ERC20, Multiple Purpose System
Timeline30/06/2022 - 05/10/2022
Methodologyhttps://hackenio.cc/sc_methodology→

    Review Scope

    Repositoryhttps://github.com/metisdac/Metis-DAC-contracts→
    Commit678222c842704ccddf9f29db7a7330f8f127b490

    Audit Summary

    Total9.1/10
    Security Score

    10/10

    Test Coverage

    7/10

    Code Quality Score

    7/10

    Documentation Quality Score

    7/10

    31Total Findings
    24Resolved
    0Accepted
    5Mitigated

    The system users should acknowledge all the risks summed up in the risks section of the report

    Document Information

    This report may contain confidential information about IT systems and the intellectual property of the Customer, as well as information about potential vulnerabilities and methods of their exploitation.

    The report can be disclosed publicly after prior consent by another Party. Any subsequent publication of this report shall be without mandatory consent.

    Document

    NameSmart Contract Code Review and Security Analysis Report for Metis
    Audited ByHacken
    Websitehttps://www.metis.io→
    Changelog14/07/2022 – Initial Review
    29/07/2022 – Second Review
    26/08/2022 – Third Review
    21/09/2022 – Fourth Review
    05/10/2022 – Fifth Review

    • Document

      Name
      Smart Contract Code Review and Security Analysis Report for Metis
      Audited By
      Hacken
      Website
      https://www.metis.io→
      Changelog
      14/07/2022 – Initial Review
      29/07/2022 – Second Review
      26/08/2022 – Third Review
      21/09/2022 – Fourth Review
      05/10/2022 – Fifth Review

    System Overview

    DAC Portal is a Decentralized Autonomous Company(DAO/DAC) that allows users to create their DACs or join an existing DAC. The project has different feature than the EVM compatible networks; the project’s main tokens, Metis ERC20 and native token act simultaneously and they can be considered as same tokens. The system consists of the following contracts:

    • AddressList — a library contract that helps store and manage addresses of DAC members and owners.

    • Configuration — a simple contract that sets the gnosisSingleton, gnosisSafeProxyFactory, ecoNodeToken, endorseCoolDown addresses by the owner.

    • constants — a Solidity file that keeps all the constant values for the project.

    • Controller — a simple contract that sets the controller proxy (such as DAC Factory or Member Manager) keys with values as their addresses.

    • DAC — a contract that is used to create a DAC (Decentralized Autonomous Company or used by users to join an existing DAC or to leave from a subscripted DAO.

    • DACFactory — an upgradable contract that generates a new deployed DAC contract for each user with the given admin addresses or allows the DAC owner to dismiss its DAC contract and sends the user’s balance to the admin’s address.

    • DACHelper — a contract that helps to view DAC properties, members, membership fee, staked users, and the amounts.

    • EcoNode — an upgradable contract that allows users to stake Metis or native tokens and allows them to unstake tokens and claim rewards.

    • MemberManager — a contract that manages members of DACs while adding or removing, and creates invitation schema.

    • Proxy — a contract that helps to deal with the storages for upgradable contracts.

    • ProxyFactory — a contract that generates(deploys) a new ControllerProxy within the given lookup name.

    • ProposalFactory — a factory contract that generates a new deployed SimpleProposal contract.

    • Reward — an ownable contract that manages staking, unstaking and allows the owner to set the reward amount and the duration.

    • RP — an upgradable contract that allows users to endorse DACs with NFTs.

    • SimpleProposal — a contract that allows DAC members to vote for a proposal in direct proportion to their contributions.

    • Singleton — a simple abstract contract that sets the Singleton Manager address.

    • SingletonManager — an upgradable contract that manages proxy factory and the singletons.

    • util — a library contract that converts uppercase characters into lowercase characters to prevent users from having the same DAC names.

    • VeMetis — a burnable and mintable ERC20 token contract that cannot be transferred by users. It has the following properties: \-Name: veMetis. \-Symbol: veMetis.

    Privileged roles

    The admin of the DAC contract can:

    • specify DAC’s managers and properties.

    • set a membership fee, fee type, and Badge membership address.

    The owner of the EcoNode contract can:

    • change the reward amount.

    • change the reward duration.

    • withdraw any ERC20 token balance of the contract.

    The owner of the Configuration contract can:

    • set the Gnosis Singleton address.

    • set the Gnosis Safe Proxy address.

    • set the EcoNode token address.

    • set the EndorseCoolDown address.

    The owner of the DACFactory contract can:

    • update the contract.

    Executive Summary

    Documentation quality

    The total Documentation quality score is 7 out of 10.

    Functional requirements are partially missed. A technical description that demonstrates the function explanations was not provided. A public whitepaper is provided.

    Code quality

    The total Code quality score is 7 out of 10.

    Unit tests were provided, but some of them failed. Style guide violation is detected. NatSpec format was mostly followed. Test coverage is 86.87%.

    All found issues are displayed in the “Findings” section.

    Architect score quality

    The total Architecture quality score of the project is 7 out of 10.

    Hardhat is used as a development environment and deployment was successful. Instructions were provided in readme. Some unused template file was detected in the project.

    Security score

    Upon auditing, the code was found to contain 4 critical, 7 high, 6 medium, and 14 low severity issues. Out of these, 24 issues have been addressed and resolved, leading to a security score of 10 out of 10.

    All identified issues are detailed in the “Findings” section of this report.

    Summary

    The comprehensive audit of the customer's smart contract yields an overall score of 9.1. This score reflects the combined evaluation of documentation, code quality, test coverage, and security aspects of the project.

    Risks

    The given contracts can work properly only on Metis network and cannot be used on EVM or EVM compatible networks since it has a different working mechanism. In Metis network, ERC20 tokens and native tokens of Metis can be considered the same. Therefore, when transferring any amount of ERC20 tokens to an address, the network sends the same amount of native tokens to the same address and vice versa.

    Findings

    Code
    ―
    Title
    Status
    Severity
    F-2023-164Denial of Service
    mitigated

    Critical
    F-2023-164Unauthorized Access
    fixed

    Critical
    F-2023-164Insufficient Balance
    mitigated

    Critical
    F-2023-1645Incorrect Function Logic
    fixed

    Critical
    F-2023-1655Highly Permissive Role Access
    mitigated

    High
    F-2023-165Funds Lock
    mitigated

    High
    F-2023-165Data Consistency
    fixed

    High
    F-2023-165Denial of Service Vulnerability
    fixed

    High
    F-2023-165Denial of Service Vulnerability
    fixed

    High
    F-2023-165 Highly Permissive Role Access
    fixed

    High
    1-10 of 31 findings

    Identify vulnerabilities in your smart contracts.

    Appendix 1. Severity Definitions

    When auditing smart contracts, Hacken is using a risk-based approach that considers Likelihood, Impact, Exploitability and Complexity metrics to evaluate findings and score severities.

    Reference on how risk scoring is done is available through the repository in our Github organization:

    Severity

    Description

    Critical
    		Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.

    High
    		High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.

    Medium
    		Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.

    Low
    		Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score.

    • Severity

      Critical

      Description

      Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.

      Severity

      High

      Description

      High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.

      Severity

      Medium

      Description

      Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.

      Severity

      Low

      Description

      Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score.

    Appendix 2. Scope

    The scope of the project includes the following smart contracts from the provided repository:

    Scope Details

    Repositoryhttps://github.com/metisdac/Metis-DAC-contracts→
    Commit678222c842704ccddf9f29db7a7330f8f127b490
    WhitepaperProvided→
    RequirementsNot provided
    Technical RequirementsNot provided

    Contracts in Scope

    contracts
    AddressList.sol - contracts/AddressList.sol
    ConfigKeys.sol - contracts/ConfigKeys.sol
    Configuration.sol - contracts/Configuration.sol
    constants.sol - contracts/constants.sol
    Controller.sol - contracts/Controller.sol
    DAC.sol - contracts/DAC.sol
    DACFactory.sol - contracts/DACFactory.sol
    DACHelper.sol - contracts/DACHelper.sol
    EcoNode.sol - contracts/EcoNode.sol
    ErrorCodes.sol - contracts/ErrorCodes.sol
    interfaces
    IBadgeManager.sol - contracts/interfaces/IBadgeManager.sol
    IController.sol - contracts/interfaces/IController.sol
    IDAC.sol - contracts/interfaces/IDAC.sol
    IDACFactory.sol - contracts/interfaces/IDACFactory.sol
    IDACHelper.sol - contracts/interfaces/IDACHelper.sol
    IEcoNode.sol - contracts/interfaces/IEcoNode.sol
    IMetisNFTBadge.sol - contracts/interfaces/IMetisNFTBadge.sol
    IMetisNFTBadgeMetadata.sol - contracts/interfaces/IMetisNFTBadgeMetadata.sol
    IProposalFactory.sol - contracts/interfaces/IProposalFactory.sol
    IProxyFactory.sol - contracts/interfaces/IProxyFactory.sol

    Disclaimer