Nonco

We express our gratitude to the Nonco team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.

Nonco swap system is a secure, owner-controlled token swap infrastructure that enforces strict address and asset-level whitelisting. It ensures that only pre-approved token pairs and wallet addresses can participate in token swap operations through a central Swap contract. The system comprises three core contracts: AddressWhitelist, AssetsWhitelist, and Swap.

The system users should acknowledge all the risks summed up in the risks section of the report

Documentation quality

• Functional requirements are partially missed.

• Technical description is not provided.

• Natspec is not sufficient.

Code quality

• Best practices are followed.

• The development environment is configured.

Test coverage

Code coverage of the project is 96.74% (branch coverage).

• Deployment and basic user interactions are covered with tests.

Nonco Swap is a secure, owner-controlled token swap infrastructure that enforces strict address and asset-level whitelisting. It ensures that only pre-approved token pairs and wallet addresses can participate in token swap operations through a central Swap contract. The system comprises three core contracts: AddressWhitelist, AssetsWhitelist, and Swap.

CONTRACTS:

1\. AddressWhitelist

• Purpose: Manages a whitelist of addresses permitted to perform swaps with each other.

• Core Features:

• • Add or remove addresses to/from an allowlist.

  • Lock/unlock the whitelist functionality (lockdown).

  • Authorize one external contract (the Swap contract) to access whitelisting checks.

  • Restricts calls to the isAddressAllowed function to either the contract owner or the authorized swap contract.

• Key Variables:

• • allowList: List of approved addresses.

  • isAllowed: Mapping to check if an address is approved.

  • isLocked: When true, disables all whitelist checks.

  • swapContractId: Authorized contract allowed to perform whitelist checks.

2\. AssetsWhitelist

• Purpose: Maintains a whitelist of token pairs allowed to be swapped.

• Core Features:

• • Approve or remove allowed token swap pairs symmetrically.

  • Lock/unlock whitelist checking for token pairs.

  • Authorize one external contract (the Swap contract) to perform allowed token checks.

  • Uses string concatenation of token addresses to track allowed pairs.

• Key Variables:

• • allowedTokens: Mapping from a token to its allowed swap partners.

  • isAllowedToken: Mapping of concatenated token pair strings to boolean values for fast lookup.

  • isLocked: Global switch to disable token pair checks.

  • swapContractId: Authorized contract allowed to check token pairs.

3\. Swap

• Purpose: Facilitates token swaps between two addresses and tokens, ensuring compliance with both address and token whitelisting.

• Core Features:

• • Calls AssetsWhitelist and AddressWhitelist before allowing a swap.

  • Verifies token balances and allowances for both parties.

  • Executes symmetric token transfer between sender and receiver using SafeTransferLib.

  • Maintains a sequential message number (msgSeqNum) for tracking or replay protection.

• Key Variables:

• • assetsWhitelist: Interface to the AssetsWhitelist contract.

  • addressWhitelist: Interface to the AddressWhitelist contract.

  • msgSeqNum: An incremental message sequence number, potentially for anti-replay logic.

ATTRIBUTES:

There are no tokens defined with typical ERC20 attributes such as name, symbol, decimals, or totalSupply in this system. The architecture is focused on swap logic and access control via whitelisting, not token issuance.

PRIVILEGED ROLES:

Owner (via Ownable)

• Can:

• • Add or remove addresses and tokens from the whitelist.

  • Enable/disable whitelist enforcement via lockdown mechanisms.

  • Set the authorized swap contract in both whitelist contracts.

  • Initiate swap transactions and update the sequence number.

Contracts where owner role is critical: AddressWhitelist, AssetsWhitelist, Swap.

The scope of the project includes the following smart contracts from the provided repository:

Assets in Scope