- Hacken
- Audits
- spacecatch
- [SCA] SpaceCatch | Smart Contracts | Jun2024
Audit name:
[SCA] SpaceCatch | Smart Contracts | Jun2024
Date:
Jun 28, 2024
Table of Content
Introduction
We express our gratitude to the SpaceCatch team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.
SpaceCatch is a GameFi project that is designed and developed by the professional gaming studio PIXELFIELD.
Document | |
|---|---|
| Name | Smart Contract Code Review and Security Analysis Report for SpaceCatch |
| Audited By | Turgay Arda Usman |
| Approved By | Grzegorz Trawinski |
| Website | https://whitepaper.spacecatch.io→ |
| Changelog | 14/06/2024 - Preliminary Report |
| 19/06/2024 - Final Report | |
| Platform | Ethereum Mainnet |
| Language | Solidity |
| Tags | Staking, Vesting, ERC20, Airdrop |
| Methodology | https://hackenio.cc/sc_methodology→ |
Document
- Name
- Smart Contract Code Review and Security Analysis Report for SpaceCatch
- Audited By
- Turgay Arda Usman
- Approved By
- Grzegorz Trawinski
- Changelog
- 14/06/2024 - Preliminary Report
- 19/06/2024 - Final Report
- Platform
- Ethereum Mainnet
- Language
- Solidity
- Tags
- Staking, Vesting, ERC20, Airdrop
- Methodology
- https://hackenio.cc/sc_methodology→
Review Scope | |
|---|---|
| Repository | https://github.com/development-at-pixelfield/spacecatch-smart-contracts→ |
| Commit | fc5eba4a500a8bf621662ce2ce41a54bb2d5ec58 |
Review Scope
- Commit
- fc5eba4a500a8bf621662ce2ce41a54bb2d5ec58
Audit Summary
The system users should acknowledge all the risks summed up in the risks section of the report
Documentation quality
Functional requirements are partially provided.
Technical description is partially provided.
Code quality
The code mostly follows best practices and style guidelines.
See observations and low issues for more details.
The development environment is configured.
Test coverage
Code coverage of the project is 62.38% (branch coverage),
Deployment and basic user interactions are covered with tests.
Negative cases coverage is partially missed.
Interactions by several users are not tested thoroughly.
System Overview
SpaceCatch is a GameFi project that is designed and developed by the professional gaming studio PIXELFIELD. It has the following contracts
CatchAirdrop — manages a phased distribution of $CATCH tokens to specified beneficiaries.
Catch — Simple ERC20 token It has the following attributes:
Name: Catch
Symbol: CATCH
Decimals: 18
Total supply: 100m tokens.
CatchStaking — Contains the staking logic.
CatchVesting — Contains the vesting logic.
BatchTransfer —This contract allows the owner to transfer tokens to multiple address in a single transaction.
Privileged roles
The Vesting Operator can upload vesting schedules for a specific round and set claimed amounts for the previous version integration.
The airdrop admin can set the token allocations for a list of beneficiaries and start the airdrop season.
The staking admin can start the staking, recover tokens, and send back stakes to stakers in case staking is cancelled.
The staking manager can set the earned rewards for initial stakers and add additional stakes for the users.
The Vesting admin can recover stuck tokens.
Risks
Making external calls within loops increases the risk of gas exhaustion, potentially leading to failed transactions and reduced contract reliability, especially when processing large datasets.
The project iterates over large dynamic arrays, which leads to excessive gas costs, risking denial of service due to out-of-gas errors, directly impacting contract usability and reliability.
The token contract’s design allows for centralized control over the transfer process, posing a risk of unauthorized token issuance, potentially diluting the token value and undermining trust in the project's economic governance
The project does not support non-standard ERC20 tokens. Adding such tokens in the future can cause additional risks.
The current version of the code does not support fee-on-transfer tokens. Adding such tokens in the future can create risk
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2024-3931 | Lock Period is not Taken Into Account During Stake Claims | mitigated | High | |
| F-2024-3930 | Recovery Functionality Only Works for Registered Token Type | fixed | Low | |
| F-2024-3929 | Airdrops Can Be Set For a Past Date | accepted | Low | |
| F-2024-3928 | Unchecked Transfer | fixed | Low | |
| F-2024-3927 | Contract And File Name Mismatch | accepted | Observation | |
| F-2024-3926 | Missing Zero Address Validation | accepted | Observation | |
| F-2024-3925 | Floating Pragma | fixed | Observation |
Appendix 1. Severity Definitions
When auditing smart contracts, Hacken is using a risk-based approach that considers Likelihood, Impact, Exploitability and Complexity metrics to evaluate findings and score severities.
Reference on how risk scoring is done is available through the repository in our Github organization:
Severity | Description |
|---|---|
Critical | Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation. |
High | High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation. |
Medium | Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category. |
Low | Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score. |
Severity
- Critical
Description
- Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.
Severity
- High
Description
- High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.
Severity
- Medium
Description
- Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.
Severity
- Low
Description
- Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score.
Appendix 2. Scope
The scope of the project includes the following smart contracts from the provided repository:
Scope Details | |
|---|---|
| Repository | https://github.com/development-at-pixelfield/spacecatch-smart-contracts→ |
| Commit | fc5eba4a500a8bf621662ce2ce41a54bb2d5ec58 |
| Whitepaper | https://whitepaper.spacecatch.io→ |
| Requirements | Provided as files. |
| Technical Requirements | Provided as files. |
Scope Details
- Commit
- fc5eba4a500a8bf621662ce2ce41a54bb2d5ec58
- Whitepaper
- https://whitepaper.spacecatch.io→
- Requirements
- Provided as files.
- Technical Requirements
- Provided as files.