Audit name:
[SCA] RE.AL | RWA-Contracts | Aug2024
Date:
Aug 13, 2024
Table of Content
Introduction
We express our gratitude to the re.al team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.
The RWA Ecosystem is a collection of smart contracts that encapsulate a collection of products built to bring a yield generating and governance protocol to active investors.
Document | |
|---|---|
| Name | Smart Contract Code Review and Security Analysis Report for re.al |
| Audited By | Olesia Bilenka |
| Approved By | Ataberk Yavuzer |
| Website | https://www.re.al/→ |
| Changelog | 07/08/2024 - Preliminary Report |
| 13/08/2024 - Final Report | |
| Platform | re.al |
| Language | Solidity |
| Tags | Yield Farming |
| Methodology | https://hackenio.cc/sc_methodology→ |
Document
- Name
- Smart Contract Code Review and Security Analysis Report for re.al
- Audited By
- Olesia Bilenka
- Approved By
- Ataberk Yavuzer
- Website
- https://www.re.al/→
- Changelog
- 07/08/2024 - Preliminary Report
- 13/08/2024 - Final Report
- Platform
- re.al
- Language
- Solidity
- Tags
- Yield Farming
- Methodology
- https://hackenio.cc/sc_methodology→
Review Scope | |
|---|---|
| Repository | https://github.com/re-al-Foundation/rwa-contracts→ |
| Commit | 433c49c |
| Remediation commit | 5cdd3f0 |
Review Scope
- Commit
- 433c49c
- Remediation commit
- 5cdd3f0
Audit Summary
The system users should acknowledge all the risks summed up in the risks section of the report
Documentation quality
Technical description and functional requirements are provided.
Natspec is provided.
Code quality
The code follows best practices and official language style guides.
The development environment is configured.
Test coverage
Code coverage of the project is 92% (branch coverage).
Deployment and basic user interactions are covered with tests.
Negative cases are covered with tests.
System Overview
RWA Ecosystem is a project with the following contracts:
RevenueStreamETH — is a contract that allows the discribution of claimable ETH revenue according to the votes or to provided signature.
RoyaltyHandler — is a contract that handles royalties from RWAToken.
Privileged roles
RoyaltyHandler: the contract owner can update distribution percentages, set slippage when fetching quotes from oracle, secondAgo value for the TWAP oracle, set distributor, oracle, ALMBox, ALMBoxManager, GaugeV2ALM, Pearl, SwapRouter addresses, the pool fee on the RWA/WETH pool, withdraw Pearl, harvest Pearl rewards, withdraw ETH and ERC-20 and updgrade the contract.
RevenueStreamETH: the revenueDistributor is allowed to deposit ETH into the contract, the contract owner is allowed to claim all expired revenue, set expiration duration for revenue, and updgrade the contract.
Risks
Scope Definition and Security Guarantees: The audit does not cover all code in the repository. Contracts outside the audit scope may introduce vulnerabilities, potentially impacting the overall security due to the interconnected nature of smart contracts.
Owner's Unrestricted State Modification: The absence of restrictions on state variable modifications by the owner leads to arbitrary changes, affecting contract integrity and user trust, especially during critical operations like minting phases.
Insufficient Multi-signature Controls for Critical Functions: The lack of multi-signature requirements for key operations centralizes decision-making power, increasing vulnerability to single points of failure or malicious insider actions, potentially leading to unauthorized transactions or configuration changes.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2024-4815 | Missing Domain Separator Leading to Unauthorized ETH Withdrawals in RevenueStreamETH | mitigated | Low | |
| F-2024-4817 | Floating Pragma | accepted | Observation | |
| F-2024-4816 | Missing Deadline in Signature Leading to Unauthorized ETH Claims in RevenueStreamETH | fixed | Observation |
Appendix 1. Severity Definitions
When auditing smart contracts, Hacken is using a risk-based approach that considers Likelihood, Impact, Exploitability and Complexity metrics to evaluate findings and score severities.
Reference on how risk scoring is done is available through the repository in our Github organization:
Severity | Description |
|---|---|
Critical | Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation. |
High | High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation. |
Medium | Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category. |
Low | Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score. |
Severity
- Critical
Description
- Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.
Severity
- High
Description
- High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.
Severity
- Medium
Description
- Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.
Severity
- Low
Description
- Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score.
Appendix 2. Scope
The scope of the project includes the following smart contracts from the provided repository:
Scope Details | |
|---|---|
| Repository | https://github.com/re-al-Foundation/rwa-contracts→ |
| Commit | 433c49cf8f661b890c84825b73dde2a8a621b7e6 |
| Remediation commit | 5cdd3f069e8f8aeaac329dffd1b6dd1d45cc0be1 |
| Whitepaper | https://docs.re.al/→ |
Scope Details
- Commit
- 433c49cf8f661b890c84825b73dde2a8a621b7e6
- Remediation commit
- 5cdd3f069e8f8aeaac329dffd1b6dd1d45cc0be1
- Whitepaper
- https://docs.re.al/→