Audit name:
[SCA] Sock | ERC4337 Implementation | Sep2023
Date:
Oct 13, 2023
Table of Content
Introduction
We express our gratitude to the Sock team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.
Sock is a mobile investing app that helps you invest crypto safely. Available on iOS and Android.
| title | content |
|---|---|
| Platform | EVM |
| Language | Solidity |
| Tags | Signatures, Staking, Proxy, Factory, ERC4337, Account Abstraction |
| Timeline | 20/09/2023 - 13/10/2023 |
| Methodology | https://hackenio.cc/sc_methodology→ |
Review Scope | |
|---|---|
| Repository | https://github.com/SockFinance/sock-account→ |
| Commit | 8009b2e |
Review Scope
- Commit
- 8009b2e
Audit Summary
10/10
93.44%
9/10
10/10
The system users should acknowledge all the risks summed up in the risks section of the report
Document Information
This report may contain confidential information about IT systems and the intellectual property of the Customer, as well as information about potential vulnerabilities and methods of their exploitation.
The report can be disclosed publicly after prior consent by another Party. Any subsequent publication of this report shall be without mandatory consent.
Document | |
|---|---|
| Name | Smart Contract Code Review and Security Analysis Report for Sock |
| Audited By | Hacken |
| Website | https://www.sock.app/→ |
| Changelog | 27/09/2023 - Initial Review |
| 13/10/2023 - Second Review |
Document
- Name
- Smart Contract Code Review and Security Analysis Report for Sock
- Audited By
- Hacken
- Website
- https://www.sock.app/→
- Changelog
- 27/09/2023 - Initial Review
- 13/10/2023 - Second Review
System Overview
SOCK is an ERC4337 compliant contract implementation designed to allow self-custody storage of cryptocurrencies in a safe and controlled space with the following contracts:
SockAccountFactory — creates and manages instances of SockAccount via proxy pattern.
SockAccount — ERC4337 compliant implementation, customized for the Sock ecosystem.
SockOwnable — provides access control mechanisms to differentiate two types of owners: owner and sockOwner.
SockRegistryAccessManager — extends the functionality of SockOwnable, providing access control mechanisms for a specific registry named sock function registry. The sock owner has the exclusive right to change the referenced sock function registry within the system.
SockRegistryImplementer — builds upon the functionality provided by SockRegistryAccessManager. Ensures that functions are allowed to be executed based on the rules defined in the sock function registry.
SockFunctionRegistry — management tool for keeping track of specific allowed functions.
UniswapV3SockProxy — gateway for interacting with UniswapV3, facilitating seamless ETH and ERC20 swaps.
ERC20SockProxy — proxy that offers direct interactions with ERC20 token methods.
SockFeeManager — converts fee tokens into a designated cashout token through Uniswap V3 and sends them to a specific cashout address.
SockFeeWhitelist — manages a whitelist of users who are exempt from “sock fees”.
Privileged roles
SockAccount Owner: Has the ability to whitelist functions that can be executed from SockAccount by the account owner and SockOwner. Add, unlock, and withdraw stakes in ERC4337 flow.
SockOwner: Can execute whitelisted functions (defined by SockAccount owner in the SockFunctionRegistry).
RecoverOwner: Can change the owner of the contract if recovery is enabled.
Protocol Owner: Set fees generated by using the UniswapV3SockProxy contract. Change fees cashOut tokens, withdraw fees, and Whitelist addresses that fees do not apply to.
Executive Summary
Documentation quality
The total Documentation quality score is 10 out of 10.
Functional requirements are provided.
Technical description is provided.
NatSpec is sufficient.
Description of the development environment is present.
Code quality
The total Code quality score is 9 out of 10.
Solidity Style Guides are violated.
Floating Pragmas are present.
There are missing validations.
Inefficient Gas model is present.
The development environment is configured.
Test coverage
Code coverage of the project is 93.44% (branch coverage).
Deployment and basic user interactions are covered with tests.
Security score
Upon auditing, the code was found to contain 2 critical, 3 high, 4 medium, and 5 low severity issues. Out of these, 12 issues have been addressed and resolved, leading to a Security score of 10 out of 10.
All identified issues are detailed in the “Findings” section of this report.
Summary
The comprehensive audit of the customer's smart contract yields an overall score of 9.5. This score reflects the combined evaluation of documentation, code quality, test coverage, and security aspects of the project.
Risks
Incorrect registry management: The SockAccount owner (protocol user) is responsible for whitelisting operations that can be performed by SockOwner. It is up to the user to manage the risk of whitelisting proper operations and smart contracts using the least privilege principle and choose a trusted SockOwner operator.
Insecure ERC4337 infrastructure: The SockAccount relies on ERC4337 infrastructure provided by an external company (Stackup →). Protocol users should verify if the Entrypoint contract assigned to SockAccount is secure. Malicious Entrypoint contracts may lead to unexpected results, for example, incorrect signature replay attacks in the case of incorrect nonce implementation.
Roles management: The SockAccount is a self-custody account. Users are responsible for securing owner and recoverOwner private keys.
UUPS proxy: The SockAccount contract is implemented using UUPS proxy, which allows contract code to change. It is necessary to secure the upgrade process and verify each contract change.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2023-0851 | SockOwner Role Can Hijack SockAccount | fixed | Critical | |
| F-2023-0850 | Missing Access Control in UUPS Upgradable Pattern Leads to SockAccount Takeover | fixed | Critical | |
| F-2023-0854 | Signature Replay Attack | fixed | High | |
| F-2023-0853 | Requirements Violation - ERC20SockProxy Cannot be Used as Proxy | fixed | High | |
| F-2023-0852 | Temporary Freezing of Funds due to Missing Parameter Update | fixed | High | |
| F-2023-0858 | Fees Cannot be Cashed Out if Fee Token and Cash Out Token Are the Same | fixed | Medium | |
| F-2023-0857 | Risk of Incorrect Slippage During Swap | fixed | Medium | |
| F-2023-0856 | Unlimited Parameter Allows Abusive Fees | fixed | Medium | |
| F-2023-0855 | Best Practice Violation; Usage of SafeERC20 | fixed | Medium | |
| F-2023-0863 | SockAccount Entrypoint Contract Address Is Set by Sock Team | unfixed | Low |
Appendix 1. Severity Definitions
When auditing smart contracts, Hacken is using a risk-based approach that considers Likelihood, Impact, Exploitability and Complexity metrics to evaluate findings and score severities.
Reference on how risk scoring is done is available through the repository in our Github organization:
Severity | Description |
|---|---|
Critical | Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation. |
High | High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation. |
Medium | Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category. |
Low | Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score. |
Severity
- Critical
Description
- Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.
Severity
- High
Description
- High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.
Severity
- Medium
Description
- Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.
Severity
- Low
Description
- Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score.
Appendix 2. Scope
The scope of the project includes the following smart contracts from the provided repository:
Scope Details | |
|---|---|
| Repository | https://github.com/SockFinance/sock-account→ |
| Commit | 8009b2e |
| Whitepaper | Not provided |
| Requirements | Provided |
| Technical Requirements | Provided |
Scope Details
- Commit
- 8009b2e
- Whitepaper
- Not provided
- Requirements
- Provided
- Technical Requirements
- Provided