Audit name:
[SCA] OpSec | OpSec-Contracts | Jul2024
Date:
Jul 26, 2024
Table of Content
Introduction
We express our gratitude to the OpSec team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.
OpSec ecosystem is a privacy-focused network dedicated to making operations on the cloud very seamless and efficient.
Document | |
|---|---|
| Name | Smart Contract Code Review and Security Analysis Report for OpSec |
| Audited By | Kornel Światłowski, Viktor Raboshchuk |
| Approved By | Przemyslaw Swiatowiec |
| Website | https://opsec.computer/→ |
| Changelog | 26/07/2024 - Preliminary Report; 26/07/2024 - Final Report |
| Platform | Ethereum |
| Language | Solidity |
| Tags | ERC20 |
| Methodology | https://hackenio.cc/sc_methodology→ |
Document
- Name
- Smart Contract Code Review and Security Analysis Report for OpSec
- Audited By
- Kornel Światłowski, Viktor Raboshchuk
- Approved By
- Przemyslaw Swiatowiec
- Website
- https://opsec.computer/→
- Changelog
- 26/07/2024 - Preliminary Report; 26/07/2024 - Final Report
- Platform
- Ethereum
- Language
- Solidity
- Tags
- ERC20
- Methodology
- https://hackenio.cc/sc_methodology→
Review Scope | |
|---|---|
| Repository | https://github.com/avierauy/opsec→ |
| Commit | a6304da6d8e5858e9694b3462d49986ab01270ea |
Review Scope
- Repository
- https://github.com/avierauy/opsec→
- Commit
- a6304da6d8e5858e9694b3462d49986ab01270ea
Audit Summary
The system users should acknowledge all the risks summed up in the risks section of the report
Documentation quality
Functional requirements are not provided.
Technical description is absent.
Code quality
The development environment is configured.
Test coverage
Code coverage of the project is 83.33% (branch coverage).
Deployment and basic user interactions are covered with tests.
Negative cases coverage is missed.
System Overview
The OpSecToken contract is a simple ERC20 token. Post-deployment, all transfers are blocked, and only addresses excluded from limits can send and receive tokens. Transfers are unlocked by the contract owner using the launch() function. The contract follows the OpenZeppelin Ownable2Step and ERC20 standards, ensuring standard access control and token functionality. All tokens are minted during deployment to contract owner, minting additional tokens is not possible. It has the following attributes:
Name: OpSec
Symbol: OPSEC
Decimals: 18
Total supply: 100000000 tokens.
Privileged roles
The OpSecToken contract uses a Ownable2Step library from OpenZeppelin to restrict access to key functions. The contract owner can:
Trigger the launch of the token.
Exclude or include accounts from limits.
Risks
Centralized Minting to a Single Address: The project concentrates minting tokens in a single address, raising the risk of fund mismanagement or theft, especially if key storage security is compromised.
Lack of Documentation: The project does not have technical and functional documentation.
Token Transfer Activation Dependency: The launch() function enables token transfer to all users. Before its execution, only addresses excluded from limits can transfer tokens. The contract owner has unrestricted authority to include and exclude addresses from limits. Failure to call the launch() function results in the possibility of transferring tokens only to addresses excluded from limits by standard users.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2024-4403 | Uncontrolled Blacklisting Mechanism in OpSecToken By Contract Owner | fixed | Low | |
| F-2024-4392 | Bot-Flagged Addresses Can Still Receive Tokens | fixed | Low | |
| F-2024-4415 | Inefficient Storage Types for launchBlock and launchTime in OpSecToken Contract | fixed | Observation | |
| F-2024-4409 | Non-descriptive _owner Argument May Cause Misunderstandings | fixed | Observation | |
| F-2024-4379 | Redundant Constant Variable in OpSecToken Contract Increase Deployment Cost | fixed | Observation | |
| F-2024-4376 | Gas Inefficiency Due to Missing Usage of Solidity Custom Errors | fixed | Observation |
Appendix 1. Severity Definitions
When auditing smart contracts, Hacken is using a risk-based approach that considers Likelihood, Impact, Exploitability and Complexity metrics to evaluate findings and score severities.
Reference on how risk scoring is done is available through the repository in our Github organization:
Severity | Description |
|---|---|
Critical | Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation. |
High | High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation. |
Medium | Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category. |
Low | Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score. |
Severity
- Critical
Description
- Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.
Severity
- High
Description
- High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.
Severity
- Medium
Description
- Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.
Severity
- Low
Description
- Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score.
Appendix 2. Scope
The scope of the project includes the following smart contracts from the provided repository:
Scope Details | |
|---|---|
| Repository | https://github.com/avierauy/opsec→ |
| Commit | a6304da6d8e5858e9694b3462d49986ab01270ea |
| Whitepaper | https://docs.opsec.computer/→ |
| Requirements | - |
| Technical Requirements | - |
Scope Details
- Repository
- https://github.com/avierauy/opsec→
- Commit
- a6304da6d8e5858e9694b3462d49986ab01270ea
- Whitepaper
- https://docs.opsec.computer/→
- Requirements
- -
- Technical Requirements
- -