Introduction
We express our gratitude to the SyFu team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.
SyFu is a Web3 wallet with GameFi (Game Finance) features that convert payment data into digital assets.
Document | |
|---|---|
| Name | Smart Contract Code Review and Security Analysis Report for SyFu |
| Audited By | Seher Saylık, Khrystyna Tkachuk |
| Approved By | Ataberk Yavuzer |
| Website | https://syfu.io/→ |
| Changelog | 18/08/2025 - Preliminary Report |
| 27/08/2025 - Final Report | |
| Platform | Binance Smart Chain |
| Language | Solidity |
| Tags | ERC20 |
| Methodology | https://hackenio.cc/sc_methodology→ |
Document
- Name
- Smart Contract Code Review and Security Analysis Report for SyFu
- Audited By
- Seher Saylık, Khrystyna Tkachuk
- Approved By
- Ataberk Yavuzer
- Website
- https://syfu.io/→
- Changelog
- 18/08/2025 - Preliminary Report
- 27/08/2025 - Final Report
- Platform
- Binance Smart Chain
- Language
- Solidity
- Tags
- ERC20
- Methodology
- https://hackenio.cc/sc_methodology→
Review Scope | |
|---|---|
| Repository | https://github.com/SyFu-Project/excavation_token→ |
| Initial Commit | 44dffaf0eb2e6f61afffdc2eddc9bff66321c2fe |
| Remediation Commit | bc9308225fdaade9167e92ee8e0ba584f5564878 |
Review Scope
- Initial Commit
- 44dffaf0eb2e6f61afffdc2eddc9bff66321c2fe
- Remediation Commit
- bc9308225fdaade9167e92ee8e0ba584f5564878
Audit Summary
The system users should acknowledge all the risks summed up in the risks section of the report
Documentation quality
Functional requirements are partially missed.
Technical description is not provided.
Code quality
NatSpec comments are not provided.
The development environment is configured.
Test coverage
Code coverage of the project is 78.57% (branch coverage).
Deployment and basic user interactions are covered with tests.
Basic pausable and upgradeability test cases are provided.
Interactions by several users are not tested thoroughly.
System Overview
SyFu is an ERC20 token with the following contracts:
SyFuExcavationToken — upgradable ERC-20 token that mints an initial supply to a deployer. Additional minting is allowed and not capped.
It has the following attributes:
Name: specified at deployment
Symbol: specified at deployment
Decimals: 18
Total supply: not capped
Privileged roles
The
MINTERrole of the SyFuExcavationToken contract can arbitrarily mint tokens to any address.The
PAUSERrole of the SyFuExcavationToken contract can pause and unpause contract transfer functionality.The
UPGRADERrole of the SyFuExcavationToken contract is responsible for upgrading contract implementation.
Potential Risks
The SyFuExcavationToken contract grants the holder of the MINTER_ROLE unlimited minting privileges, meaning new tokens can be created at any time; this introduces dilution/inflation risk.
The SyFuExcavationToken contract is implemented as an upgradeable contract, allowing the designated administrator to modify its logic in the future. While this provides flexibility to address issues and evolve the project, it also introduces risks if the upgrade process is not properly managed or secured, as upgrades may change functionality, rules, or balances and could compromise the project’s integrity and security.
The PAUSER role of the SyFuExcavationToken can pause and unpause contract's transfer functionality.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2025-1219 | Missing Storage Gap | fixed | Low | |
| F-2025-1218 | Unlimited Minting Capability via MINTER_ROLE | accepted | Low | |
| F-2025-1218 | Missing Zero Address Validation | fixed | Observation | |
| F-2025-1218 | Public Function not Used Internally can be Marked External | fixed | Observation | |
| F-2025-1218 | Floating Pragma | fixed | Observation |
Appendix 1. Definitions
Severities
When auditing smart contracts, Hacken is using a risk-based approach that considers Likelihood, Impact, Exploitability and Complexity metrics to evaluate findings and score severities.
Reference on how risk scoring is done is available through the repository in our Github organization:
Severity | Description |
|---|---|
Critical | Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation. |
High | High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation. |
Medium | Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category. |
Low | Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution. |
Severity
- Critical
Description
- Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.
Severity
- High
Description
- High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.
Severity
- Medium
Description
- Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.
Severity
- Low
Description
- Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution.
Potential Risks
The "Potential Risks" section identifies issues that are not direct security vulnerabilities but could still affect the project’s performance, reliability, or user trust. These risks arise from design choices, architectural decisions, or operational practices that, while not immediately exploitable, may lead to problems under certain conditions. Additionally, potential risks can impact the quality of the audit itself, as they may involve external factors or components beyond the scope of the audit, leading to incomplete assessments or oversight of key areas. This section aims to provide a broader perspective on factors that could affect the project's long-term security, functionality, and the comprehensiveness of the audit findings.
Appendix 2. Scope
The scope of the project includes the following smart contracts from the provided repository:
Scope Details | |
|---|---|
| Repository | https://github.com/SyFu-Project/excavation_token→ |
| Initial Commit | 44dffaf0eb2e6f61afffdc2eddc9bff66321c2fe |
| Remediation Commit | bc9308225fdaade9167e92ee8e0ba584f5564878 |
| Whitepaper | https://syfu.io/whitepaper/SyFu_White_paper_ver1.0_en.pdf→ |
| Requirements | N/A |
| Technical Requirements | N/A |
Scope Details
- Initial Commit
- 44dffaf0eb2e6f61afffdc2eddc9bff66321c2fe
- Remediation Commit
- bc9308225fdaade9167e92ee8e0ba584f5564878
- Requirements
- N/A
- Technical Requirements
- N/A
Assets in Scope
Appendix 3. Additional Valuables
Additional Recommendations
The smart contracts in the scope of this audit could benefit from the introduction of automatic emergency actions for critical activities, such as unauthorized operations like ownership changes or proxy upgrades, as well as unexpected fund manipulations, including large withdrawals or minting events. Adding such mechanisms would enable the protocol to react automatically to unusual activity, ensuring that the contract remains secure and functions as intended.
To improve functionality, these emergency actions could be designed to trigger under specific conditions, such as:
Detecting changes to ownership or critical permissions.
Monitoring large or unexpected transactions and minting events.
Pausing operations when irregularities are identified.
These enhancements would provide an added layer of security, making the contract more robust and better equipped to handle unexpected situations while maintaining smooth operations.