Audit name:
[SCA] NF3x | DEX | Nov2023
Date:
Nov 16, 2023
Table of Content
Introduction
We express our gratitude to the NF3x team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.
NF3x is a multi-asset swaps and options platform to barter, reserve & exchange your favourite NFT collections, entirely peer-to-peer.
| title | content |
|---|---|
| Platform | EVM |
| Language | Solidity |
| Tags | Exchange |
| Timeline | 25/10/2023 - 17/11/2023 |
| Methodology | https://hackenio.cc/sc_methodology→ |
Review Scope | |
|---|---|
| Repository | https://github.com/NF3Labs/OTC-Broking-Protocol→ |
| Commit | 80df06ae |
Review Scope
- Commit
- 80df06ae
Audit Summary
10/10
97.1%
10/10
10/10
The system users should acknowledge all the risks summed up in the risks section of the report
Document Information
This report may contain confidential information about IT systems and the intellectual property of the Customer, as well as information about potential vulnerabilities and methods of their exploitation.
The report can be disclosed publicly after prior consent by another Party. Any subsequent publication of this report shall be without mandatory consent.
Document | |
|---|---|
| Name | Smart Contract Code Review and Security Analysis Report for NF3x |
| Audited By | Hacken |
| Website | https://nf3.exchange/→ |
| Changelog | 02/11/2023 - Initial Review |
| 17/11/2023 - Second Review |
Document
- Name
- Smart Contract Code Review and Security Analysis Report for NF3x
- Audited By
- Hacken
- Website
- https://nf3.exchange/→
- Changelog
- 02/11/2023 - Initial Review
- 17/11/2023 - Second Review
System Overview
The NF3x Broker's Protocol is designed to facilitate secure and trustless over-the-counter (OTC) trading of Fungible Token (FT) and Non-Fungible Tokens (NFTs) through intermediaries (“third-parties/brokers”).
Its primary purpose is to facilitate swaps & trades for users that are looking to buy specific assets, swap between assets or sell an asset. This protocol simplifies the process of finding suitable counterparties and completing OTC swaps through a third-parties network.
Brokers.sol: Central contract governing the OTC Broking Protocol. It facilitates the trust trading mechanism by utilizing brokers as intermediaries between users. Within this contract, the key functionalities include token swaps, ensuring the validity of trades through sanity checks, transferring fees, and managing trade nonces.
IBrokers.sol: An interface contract for Brokers.sol.
BrokersSignatureUtils.sol: This contract manages the creation and verification of EIP-712 compliant signatures for broker swaps in a trading system. It focuses on hashing and validating trade data, assets, fees, and related trade information.
BrokersStorage.sol: An abstract storage contract that serves the main Brokers contract, primarily managing nonces for users. Utilizing the OpenZeppelin's BitMaps structure, it allows for efficient setting and retrieval of nonces for specific user addresses.
BrokersTokenTransferrer.sol: An abstract contract derived from the BrokersStorage contract, specialized in managing the transfer of various asset types, especially in the context of the Brokers protocol.
DataTypes.sol: This file defines the main data structures and enumerations utilized in the Brokers protocol, aiding in the organization and handling of assets, fees, and trade-related data.
Privileged roles
Owner: The owner can set minimum fees for platform and the platform address where fees will be transferred.
Executive Summary
Documentation quality
The total Documentation quality score is 10 out of 10.
Functional requirements are provided:
Project overview is detailed.
Deployment instructions are provided.
All roles in the system are described.
Use cases are described and detailed.
For each contract, all futures are described.
All interactions are described.
The technical requirements are provided:
Technical specification is provided.
The description of the development environment is provided.
Code quality
The total Code quality score is 10 out of 10.
The code is structured and readable.
The development environment is configured.
Best practices are followed.
Test coverage
Code coverage of the project is 97.1% (branch coverage).
Not all branches are covered with tests.
Security score
Upon auditing, the code was found to contain 2 critical, 0 high, 0 medium, and 1 low severity issues. Out of these, 3 issues have been addressed and resolved, leading to a Security score of 10 out of 10.
All identified issues are detailed in the “Findings” section of this report.
Summary
The comprehensive audit of the customer's smart contract yields an overall score of 9.9. This score reflects the combined evaluation of documentation, code quality, test coverage, and security aspects of the project.
Risks
No potential security risks were found during the audit research.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2023-0718 | Missing Fee Token And Platform Control | fixed | Critical | |
| F-2023-0717 | Missing platformAmount Control | fixed | Critical | |
| F-2023-0719 | Floating Pragma | fixed | Low | |
| I-2023-0176 | Inappropriate Use of unchecked Block Scope in _transferAssets Function | fixed | Observation | |
| I-2023-0175 | Ownership Irrevocability Vulnerability in Smart Contract | fixed | Observation | |
| I-2023-0174 | Unconditional Event Emission in Fee Transfer Function | unfixed | Observation | |
| I-2023-0173 | event Declared But Not Emitted | fixed | Observation | |
| I-2023-0172 | Redundant Inheritance Of Ownable in Brokers Contract | fixed | Observation | |
| I-2023-0171 | Avoid Unnecessary Initializations Of Uint256 And Bool Variable To 0/false | fixed | Observation |
Appendix 1. Severity Definitions
When auditing smart contracts, Hacken is using a risk-based approach that considers Likelihood, Impact, Exploitability and Complexity metrics to evaluate findings and score severities.
Reference on how risk scoring is done is available through the repository in our Github organization:
Severity | Description |
|---|---|
Critical | Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation. |
High | High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation. |
Medium | Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category. |
Low | Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score. |
Severity
- Critical
Description
- Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.
Severity
- High
Description
- High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.
Severity
- Medium
Description
- Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.
Severity
- Low
Description
- Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score.
Appendix 2. Scope
The scope of the project includes the following smart contracts from the provided repository:
Scope Details | |
|---|---|
| Repository | https://github.com/NF3Labs/OTC-Broking-Protocol→ |
| Commit | 80df06ae |
| Whitepaper | Provided→ |
| Requirements | Provided→ |
| Technical Requirements | Provided→ |