- Hacken
- Audits
- venom-blockchain-holding-limited
- [SCA] Venom Blockchain | TIP-3.1 Token | Jun2022
Audit name:
[SCA] Venom Blockchain | TIP-3.1 Token | Jun2022
Date:
Jun 21, 2022
Table of Content
Introduction
We express our gratitude to the VENOM Blockchain Holding Limited team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.
TIP-3.1 contracts for TON/ETH bridge is a system of contracts that implements the fungible token interface.
| title | content |
|---|---|
| Platform | TVM |
| Language | Solidity |
| Tags | TIP-3.1 token |
| Timeline | 03/05/2022 – 21/06/2022 |
| Methodology | https://hackenio.cc/sc_methodology→ |
Review Scope | |
|---|---|
| Repository | https://github.com/broxus/ton-eth-bridge-token-contracts→ |
| Commit | 6503e61880c03fb45741c177c25f4955dca5f0df |
Review Scope
- Commit
- 6503e61880c03fb45741c177c25f4955dca5f0df
Audit Summary
7/10
5/10
7/10
5/10
The system users should acknowledge all the risks summed up in the risks section of the report
Document Information
This report may contain confidential information about IT systems and the intellectual property of the Customer, as well as information about potential vulnerabilities and methods of their exploitation.
The report can be disclosed publicly after prior consent by another Party. Any subsequent publication of this report shall be without mandatory consent.
Document | |
|---|---|
| Name | Smart Contract Code Review and Security Analysis Report for VENOM Blockchain Holding Limited |
| Audited By | Hacken |
| Approved By | Hacken |
| Changelog | 13/05/2022 – Initial Review |
| 20/05/2022 – Second Review | |
| 21/06/2022 – Third Review |
Document
- Name
- Smart Contract Code Review and Security Analysis Report for VENOM Blockchain Holding Limited
- Audited By
- Hacken
- Approved By
- Hacken
- Changelog
- 13/05/2022 – Initial Review
- 20/05/2022 – Second Review
- 21/06/2022 – Third Review
System Overview
TIP-3.1 contracts for TON/ETH bridge is a system of contracts that implements the fungible token interface:
TokenRoot (TokenRootUpgradeable) — contract that implements such features for token platform owner:
burning tokens from user wallet.
minting tokens to user wallet.
stop burning ability from user wallet.
stop minting ability to user wallet.
pause burning ability by users.
transfer ownership with triggering callback of specified.
upgrade wallet code and code of the root contract.
TokenWallet (TokenWalletUpgradeable and TokenWalletPlatform) — contract that implements such features for token platform users:
burning tokens.
transfer the TIP-3.1 token to another wallet.
Privileged roles
The owner of the TokenRoot (TokenRootUpgradeable) contract can arbitrarily change the balance of selected users and pause burning assets by users.
Executive Summary
Documentation quality
The total Documentation quality score is 5 out of 10.
Good functional requirements and no technical description.
Code quality
The total Code quality score is 7 out of 10.
Some code duplications were included.
Unit Tests do not process cases of interaction by several users and the root owner.
Architecture quality
Code coverage of the project is 5 out of 10.
The code contains hardcoded nondeclarative function and interface ids on which upgradable contracts lean.
The system is overwhelmed with low-level code that could be declared in special functions or modifiers.
Security score
Upon auditing, the code was found to contain 1 critical, 0 high, 2 medium, and 3 low severity issues. Out of these, 0 issues have been addressed and resolved, leading to a security score of 7 out of 10.
All identified issues are detailed in the “Findings” section of this report.
Summary
The comprehensive audit of the customer's smart contract yields an overall score of 6.6. This score reflects the combined evaluation of documentation, code quality, architecture quality, and security aspects of the project.
Risks
This is only part of the whole project, and a valuable security part is entrusted to dApp. Ensure using the official dApp and corresponding audit is provided. In another way, any transactions may be executed partially (look Missing Gas management critical issue for details).
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2022-1943 | Missing Gas management | mitigated | Critical | |
| F-2022-1945 | Mixing reserving patterns | unfixed | Medium | |
| F-2022-1944 | Wrong data packing | unfixed | Medium | |
| F-2022-194 | Floating Pragma | unfixed | Low | |
| F-2022-194 | Outdated compiler version | unfixed | Low | |
| F-2022-1946 | Missing variable visibility | unfixed | Low |
Appendix 1. Severity Definitions
When auditing smart contracts, Hacken is using a risk-based approach that considers Likelihood, Impact, Exploitability and Complexity metrics to evaluate findings and score severities.
Reference on how risk scoring is done is available through the repository in our Github organization:
Severity | Description |
|---|---|
Critical | Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation. |
High | High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation. |
Medium | Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category. |
Low | Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score. |
Severity
- Critical
Description
- Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.
Severity
- High
Description
- High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.
Severity
- Medium
Description
- Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.
Severity
- Low
Description
- Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score.
Appendix 2. Scope
The scope of the project includes the following smart contracts from the provided repository:
Scope Details | |
|---|---|
| Repository | https://github.com/broxus/ton-eth-bridge-token-contracts→ |
| Commit | 6503e61880c03fb45741c177c25f4955dca5f0df |
| Whitepaper | Provided→ |
| Requirements | Provided→ |
| Technical Requirements | Not provided |