Audit name:
[SCA] Parallax | NFT Vault | Jan2023
Date:
Mar 1, 2023
Table of Content
Introduction
We express our gratitude to the Parallax team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.
Parallax → aims to be the meta-strategy hub with a keen focus on LSDfi products.
| title | content |
|---|---|
| Platform | EVM |
| Language | Solidity |
| Tags | ERC721, Vault, Yield Strategy |
| Timeline | 04/01/2023 - 03/03/2023 |
| Methodology | https://hackenio.cc/sc_methodology→ |
Review Scope | |
|---|---|
| Repository | https://bitbucket.ideasoft.io/projects/PAR/repos/solidity→ |
| Commit | 8bd4562ece9e838956a0295a1ba10f76b8b5da4a |
Review Scope
- Commit
- 8bd4562ece9e838956a0295a1ba10f76b8b5da4a
Audit Summary
10/10
100%
10/10
10/10
The system users should acknowledge all the risks summed up in the risks section of the report
Document Information
This report may contain confidential information about IT systems and the intellectual property of the Customer, as well as information about potential vulnerabilities and methods of their exploitation.
The report can be disclosed publicly after prior consent by another Party. Any subsequent publication of this report shall be without mandatory consent.
Document | |
|---|---|
| Name | Smart Contract Code Review and Security Analysis Report for Parallax |
| Audited By | Hacken |
| Website | https://parallaxfinance.org/→ |
| Changelog | 11/01/2023 - Initial Review |
| 06/02/2023 - Second Review | |
| 03/03/2023 - Third Review |
Document
- Name
- Smart Contract Code Review and Security Analysis Report for Parallax
- Audited By
- Hacken
- Changelog
- 11/01/2023 - Initial Review
- 06/02/2023 - Second Review
- 03/03/2023 - Third Review
System Overview
Parallax is a platform that allows different compounding strategies; at the moment, in the scope of the audit, there is only one, CurveSorbetteriesStrategy, that allows users to deposit into the USDC-USDT-MIM LP on curve and auto-compound the rewards.
When a position is created, the user receives an ERC721 that is burned on complete withdrawal and used to transfer the position to another user.
The files in the scope:
TokenRescuer.sol - Contract to rescue tokens and native coins wrongfully sent to parallax and Strategy contracts.
IParallax.sol - Interface for the parallax contract.
IParallaxStrategy.sol - Interface for the parallax strategy.
ITokenRescuer.sol - Interface for the TokenRescuer.
Parallax.sol - Main contract that allows the owner to add new strategies and users to deposit, withdraw positions and transfer NFTs.
CurveSorbetterieStrategy.sol - First strategy that uses curve as base layer, compounding the rewards of a LP on curve.
ICurve.sol - Interface to interact with curve.
ISorbetterie.sol - Interface for the first strategy.
Timelock.sol - The contract to handle timelocks in case of state changes in the contract to give users time to react.
CheckerZeroAddr.sol - The contract responsible for zero address checks.
ERC721UpgradeableParallax.sol - The system NFT that is used for confirmation of positions.
IERC721UpgradeableParallax.sol - The interface for ERC721UpgradeableParallax.sol.
IFees.sol - The contract to hold the withdrawal fees.
Flow of the project:
Privileged roles
Roles defined in the system:
Owner: The owner of the parallax contract can:
Rescue tokens sent wrongfully to the contract parallax and strategy contracts (both native and non native).
Whitelist and unwhitelist a token that can be deposited.
Add a strategy and modify its parameters.
User: The user in the parallax system can:
Open positions and do deposits, withdrawals, and token transfers.
Executive Summary
Documentation quality
The total Documentation quality score is 10 out of 10.
Functional requirements are detailed.
Technical description is precise.
There is a diagram explaining the flow.
NatSpec covers most of the code.
Code quality
The total Code quality score is 10 out of 10.
The development environment is configured.
The code is structured and function/contract interactions are clear.
Test coverage
Code coverage of the project is 100% (branch coverage).
Deployment and basic user interactions are covered with tests.
Negative cases coverage is present.
Interactions by several users are tested thoroughly.
Security score
Upon auditing, the code was found to contain 1 critical, 4 high, 5 medium, and 20 low severity issues. Out of these, 30 issues have been addressed and resolved, leading to a Security score of 10 out of 10.
All identified issues are detailed in the “Findings” section of this report.
Summary
The comprehensive audit of the customer's smart contract yields an overall score of 10. This score reflects the combined evaluation of documentation, code quality, test coverage, and security aspects of the project.
Risks
The project relies on external factors:
USDT-USDC-MIM peg for the first strategy.
Sushiswap.
USDT, USDC, MIM liquidity on Sushiswap with themselves and other ERC20/ETH.
There are swaps to deposit and withdraw with whitelisted ERC20 and ETH, which creates a possibility for a race condition where they could be subject to a sandwich attack or lose a part of the deposit due to slippage.
The upgradeable nature of the contracts puts the user funds at risk in case of logic upgrade.
The system relies on the secureness of the Owner's private keys, which can impact the execution flow and secureness of the funds. We recommend this account to be at least ⅗ multi-sig.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2023-0869 | Invalid Hardcoded Value | fixed | Critical | |
| F-2023-0873 | Checks-Effects-Interactions Pattern Violation | fixed | High | |
| F-2023-0872 | Invalid Calculations | fixed | High | |
| F-2023-0871 | Denial of Service | fixed | High | |
| F-2023-0870 | Front-Running Attack | fixed | High | |
| F-2023-0878 | Unchecked Input Value | fixed | Medium | |
| F-2023-0877 | Contradiction - Documentation Mismatch | fixed | Medium | |
| F-2023-0876 | Unscalable Functionality - Bad Struct Naming | fixed | Medium | |
| F-2023-0875 | Best Practice Violation - Unchecked Transfer | fixed | Medium | |
| F-2023-0874 | Admin Privilege Actions | fixed | Medium |
Appendix 1. Severity Definitions
When auditing smart contracts, Hacken is using a risk-based approach that considers Likelihood, Impact, Exploitability and Complexity metrics to evaluate findings and score severities.
Reference on how risk scoring is done is available through the repository in our Github organization:
Severity | Description |
|---|---|
Critical | Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation. |
High | High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation. |
Medium | Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category. |
Low | Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score. |
Severity
- Critical
Description
- Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.
Severity
- High
Description
- High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.
Severity
- Medium
Description
- Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.
Severity
- Low
Description
- Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score.
Appendix 2. Scope
The scope of the project includes the following smart contracts from the provided repository:
Scope Details | |
|---|---|
| Repository | https://bitbucket.ideasoft.io/projects/PAR/repos/solidity→ |
| Commit | 8bd4562ece9e838956a0295a1ba10f76b8b5da4a |
| Whitepaper | Not provided |
| Requirements | Provided→ |
| Technical Requirements | Provided→ |