VOLTARA

We express our gratitude to the VOLTARA team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.

Voltara is a Proof of Green Work (PoGW) protocol that tokenizes verified renewable energy generation. Energy producers submit IoT sensor data through oracle-authorized transactions, which are validated on-chain and converted into VTRX (Voltara Impact Token) rewards representing environmental impact, with optional minting of soulbound NFT certificates at achievement milestones.

The system users should acknowledge all the risks summed up in the risks section of the report

Documentation quality

Functional requirements are partially documented. Technical description is provided in code comments but lacks a formal specification document.

• README.md provides a high-level protocol overview with architecture flow and quick start instructions.

• AUDIT_SCOPE.md clearly defines the six in-scope contracts and explicitly excludes deprecated/ and phase2/ directories.

• CONTRACT_REFERENCE.md contains detailed descriptions of each contract's purpose, key functions, and session-by-session modification history including all audit fixes (V-01 through V-18).

• NatSpec comments are present throughout contracts with @notice and @dev annotations documenting security fixes and design decisions.

• Audit fix comments (V-01 through V-18, plus F-2026-18xxx series) document security improvements with rationale.

• No whitepaper or formal architecture diagrams are provided.

Code quality

The codebase properly reuses well-audited libraries instead of reimplementing common patterns. Development environment is fully configured with appropriate tooling.

• OpenZeppelin v5.0.1 contracts are used for ERC-20, ERC-721, AccessControl, Pausable, SafeERC20, and ReentrancyGuard.

• Chainlink Functions v1.2.0 library is used for oracle integration.

• Hardhat development environment is configured with Solidity 0.8.20 (locked pragma), optimizer enabled (200 runs).

• Custom errors are used throughout for gas-efficient reverts.

• TypeChain is configured for type-safe contract interactions.

• Code follows consistent naming conventions and logical grouping.

• Legacy sendVerificationRequest function has been removed from VoltaraChainlinkConsumer.

• Constructor role separation implemented across all contracts (FIBTreasury, PoGWUnified, VoltaraImpactNFT).

• Consistent whenNotPaused modifier application across all state-changing functions.

Test coverage

Code coverage of the project is 50.64% (branch coverage).

• 130 passing tests covering deployment, authorization, energy calculations, idempotency, reward distribution, pausable behavior, and integration scenarios.

• VoltaraChainlinkConsumer has lower coverage due to Chainlink DON callback simulation limitations.

• Negative cases coverage includes error handling paths for access control, input validation, and boundary conditions.

• Integration stress test validates 20 sessions across 2 projects without reverts.

The protocol follows a hub-and-spoke architecture centered on PoGWUnified, which serves as the sole processing engine for energy data and VTRX minting. Authorized oracles submit verified energy readings (in watt-hours) along with cryptographic payload hashes for idempotency. The contract calculates VTRX rewards using a configurable rate multiplied by a grid emission factor, splitting minted tokens 98% to the project owner and 2% to the FIBTreasury. Cumulative energy is tracked in watt-hours (preserving sub-kWh precision), and when thresholds are reached, the engine may mint tiered soulbound NFT certificates through VoltaraImpactNFT.

VoltaraRegistry maintains an on-chain registry of projects and energy snapshots but has been decoupled from VTRX token operations. The contract anchors verified data and records units for audit purposes but no longer mints or burns tokens—this architectural change eliminates the cross-path double-minting risk that previously existed. Both PoGWUnified and VoltaraRegistry enforce hash-based deduplication to prevent processing of the same energy reading twice. VoltaraChainlinkConsumer provides an optional verification layer by querying Chainlink Functions to validate IoT readings against off-chain APIs before allowing reward processing.

The system implements OpenZeppelin's AccessControl throughout, with distinct roles governing minting (MINTER_ROLE, ORACLE_ROLE), burning (BURNER_ROLE), treasury operations (TREASURY_ADMIN), and oracle submissions (ISSUER_ROLE). Emergency controls via Pausable exist on all six contracts. Constructor-level role separation enforces distinct addresses for administrative and operational roles at deployment. VoltaraImpactToken implements ERC-20 with a hard cap of 1 billion tokens, administrative burn capabilities, and pause exemption for burns. VoltaraImpactNFT implements ERC-721 with soulbound transfer restrictions, an adjustable five-tier classification system, and role-protected burning for certificate revocation.

VoltaraImpactToken.sol — ERC-20 reward token representing verified energy impact. Implements role-gated mint and adminBurn functions, enforces a 1 billion token supply cap with warnings at 90%, and provides pausable transfers with burn exemption for emergency revocations.

• VoltaraImpactNFT.sol — Soulbound ERC-721 certificate representing verified clean energy milestones. Implements a five-tier system (SEED through DIAMOND) based on kWh thresholds, blocks all transfers between addresses (allows minting and burning), supports tier-aware minting via mintCertificateWithTier, retirement certificates via mintRetirementCertificate, and role-protected burning via burn.

• VoltaraChainlinkConsumer.sol — Oracle connector integrating Chainlink Functions for off-chain verification of IoT energy data. Manages concurrent request tracking via pendingRequests mapping, correlates request IDs to payload hashes, validates subscription and DON configuration before requests, exposes isVerified for gating reward processing, and supports configurable callback gas limits.

• FIBTreasury.sol — Treasury contract holding the 2% protocol fee from all VTRX minting. Implements tiered withdrawal controls with a 48-hour timelock for amounts exceeding 100,000 tokens via queueWithdrawal and cancelWithdrawal. Supports release of both native POL and ERC-20 tokens via releaseFunds using SafeERC20 for non-compliant token compatibility.

• VoltaraRegistry.sol — Decentralized registry for projects and energy snapshots. Anchors verified data via anchorSnapshot with impact hash deduplication and configurable maximum units per snapshot. Stores subproject details (name, capacity, GPS) on-chain with retrieval via getSubprojectDetails. Supports snapshot revocation with hash clearing to allow resubmission. No longer performs VTRX minting or burning operations.

• PoGWUnified.sol — Core protocol engine and sole VTRX minting path. Processes verified energy sessions from oracles with enforced on-chain idempotency via payload hash tracking. Calculates and distributes VTRX rewards with 98/2 split, maintains cumulative energy in watt-hours per project for accurate NFT tier assignment, and optionally gates processing on Chainlink verification status. Separate registerProject and updateProject functions prevent accidental overwrites.

Privileged roles

VoltaraImpactTokensol

DEFAULT_ADMIN_ROLE: Controls emergency operations and role management.

• Can call pause to halt all token transfers (mints and user transfers).

• Can call unpause to resume token transfers.

• Can grant and revoke MINTER_ROLE and BURNER_ROLE.

MINTER_ROLE: Authorized to create new VTRX tokens.

• Can call mint to mint VTRX tokens to any address (subject to hard cap of 1 billion VTRX).

BURNER_ROLE: Authorized to destroy tokens without owner approval.

• Can call adminBurn to burn VTRX from any address unilaterally (without allowance). Burns bypass pause restriction.

VoltaraImpactNFTsol

DEFAULT_ADMIN_ROLE: Controls tier configuration, emergency operations, and role management.

• Can call setTierThresholds to modify kWh thresholds for SEED/BRONZE/SILVER/GOLD/DIAMOND tiers.

• Can call pause to halt minting operations.

• Can call unpause to resume minting operations.

• Can grant and revoke MINTER_ROLE, RETIREMENT_ROLE, and BURNER_ROLE.

MINTER_ROLE: Authorized to issue impact certificates.

• Can call mintCertificate to mint soulbound impact certificates to any address.

• Can call mintCertificateWithTier to mint certificates with tier assignment based on kWh.

RETIREMENT_ROLE: Authorized to issue retirement certificates.

• Can call mintRetirementCertificate to mint soulbound retirement certificates for VTRX offsetting.

BURNER_ROLE: Authorized to revoke certificates.

• Can call burn to destroy any certificate (NFT). Burns bypass pause restriction.

VoltaraChainlinkConsumersol

DEFAULT_ADMIN_ROLE: Controls oracle configuration, emergency operations, and role management.

• Can call setDefaultConfig to set default JavaScript source, Chainlink subscription ID, DON ID, and callback gas limit.

• Can call pause to halt verification requests.

• Can call unpause to resume verification requests.

• Can grant and revoke ISSUER_ROLE.

ISSUER_ROLE: Authorized to initiate Chainlink verification requests.

• Can call requestVerification to send verification requests using default configuration.

• Can call requestVerificationWithSource to send requests with custom JavaScript source (validates subscription and DON configuration).

FIBTreasurysol

DEFAULT_ADMIN_ROLE: Controls emergency operations and role management.

• Can call pause to halt all fund operations.

• Can call unpause to resume fund operations.

• Can grant and revoke TREASURY_ADMIN.

TREASURY_ADMIN: Authorized to manage fund releases from the treasury.

• Can call queueWithdrawal to queue withdrawals exceeding 100,000 tokens with 48-hour timelock.

• Can call cancelWithdrawal to cancel queued withdrawals.

• Can call releaseFunds to transfer native POL or any ERC-20 token to any recipient. Amounts exceeding 100,000 tokens require prior queuing and timelock expiration.

VoltaraRegistrysol

DEFAULT_ADMIN_ROLE: Controls project management, snapshot revocation, and emergency operations.

• Can call adminRegisterSubproject to register new global subprojects with beneficiary addresses and on-chain details.

• Can call registerProject to register projects with beneficiary and metadata.

• Can call setProjectActive to activate or deactivate existing projects (respects pause).

• Can call updateProjectMetadata to modify project metadata URIs (respects pause).

• Can call updateProjectBeneficiary to change project beneficiary address.

• Can call setMaxUnitsPerSnapshot to configure maximum units allowed per snapshot.

• Can call revokeSnapshot to revoke fraudulent snapshots (clears processed hash for resubmission).

• Can call pause to halt snapshot anchoring and project registration.

• Can call unpause to resume registry operations.

• Can grant and revoke ISSUER_ROLE.

ISSUER_ROLE: Authorized to anchor energy snapshots.

• Can call anchorSnapshot to record verified energy data with units (no longer triggers VTRX minting).

PoGWUnifiedsol

DEFAULT_ADMIN_ROLE: Controls protocol configuration, project management, and emergency operations.

• Can call registerProject to register new projects with owners and reward rates (rejects duplicates).

• Can call updateProject to modify existing project owners, reward rates, and active status (rejects non-existent projects).

• Can call deactivateProject to disable a project from receiving further rewards.

• Can call setFibTreasury to change the FIB treasury address for the 2% fee split (emits event).

• Can call setMaxSessionWh to adjust the maximum Wh allowed per energy report (emits event).

• Can call setMaxGridEmissionFactor to bound the oracle-supplied grid emission factor (emits event).

• Can call setChainlinkConsumer to set the Chainlink verification contract address (emits event).

• Can call setChainlinkVerification to enable or disable mandatory Chainlink verification.

• Can call pause to halt all energy report processing.

• Can call unpause to resume energy report processing.

• Can grant and revoke ORACLE_ROLE.

ORACLE_ROLE: Authorized to submit verified energy data and trigger rewards.

• Can call processSession to process energy reports, mint VTRX (98% to owner, 2% to FIB), accumulate cumulative Wh, and optionally mint NFT certificates.

The scope of the project includes the following smart contracts from the provided repository:

Assets in Scope