Q2 2026 Security & Compliance Report67 incidents, $764M in losses, 88% from operational failures.
Get the report →
Wolfer Finance logo

Wolfer Finance

Audit name:

[SCA] Wolfer Finance | Presend Claiming Tokenomics | Apr2024

Date:

Apr 24, 2024

Table of Content

→Introduction
→Audit Summary
→Document Information
→System Overview
→Executive Summary
→Risks
→Findings
→Appendix 1. Severity Definitions
→Appendix 2. Scope
→Disclaimer

Want a comprehensive audit report like this?

Introduction

We express our gratitude to the Wolfer Finance team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.

The Wolfer Finance system, built on Ethereum, facilitates the distribution of rewards to NFT owners within the Wolfer ecosystem.

titlecontent
PlatformEVM
LanguageSolidity
TagsReward Distribution
Timeline05/04/2024 - 08/04/2024
Methodologyhttps://hackenio.cc/sc_methodology→

    Review Scope

    Repositoryhttps://github.com/Presend-DeFi/presend-claiming-tokenomics→
    Commit96bca25
    Remediation Commita48f292

    Audit Summary

    Total8.4/10
    Security Score

    10/10

    Test Coverage

    73%

    Code Quality Score

    8/10

    Documentation Quality Score

    8/10

    12Total Findings
    6Resolved
    4Accepted
    2Mitigated

    The system users should acknowledge all the risks summed up in the risks section of the report

    Document Information

    This report may contain confidential information about IT systems and the intellectual property of the Customer, as well as information about potential vulnerabilities and methods of their exploitation.

    The report can be disclosed publicly after prior consent by another Party. Any subsequent publication of this report shall be without mandatory consent.

    Document

    NameSmart Contract Code Review and Security Analysis Report for Wolfer Finance
    Audited ByKaan Caglan
    Approved ByAtaberk Yavuzer, Grzegorz Trawiński
    Websitehttps://wolfer.finance/→
    Changelog08/04/2024 - Preliminary Report
    17/04/2024 - Final Report

    • Document

      Name
      Smart Contract Code Review and Security Analysis Report for Wolfer Finance
      Audited By
      Kaan Caglan
      Approved By
      Ataberk Yavuzer, Grzegorz Trawiński
      Website
      https://wolfer.finance/→
      Changelog
      08/04/2024 - Preliminary Report
      17/04/2024 - Final Report

    System Overview

    Wolfer Finance System Overview

    Definition: The Wolfer Finance system, built on Ethereum, facilitates the distribution of rewards to NFT owners within the Wolfer ecosystem. Utilizing a combination of two contracts, RewardsBase and WolferRewards, it offers a flexible and secure way to manage rewards through ERC20 tokens, including native currency options.

    Contracts:

    RewardsBase:

    • Purpose: Serves as the foundational contract for managing reward distributions. It includes functionalities such as reward injections, claims, pausing/unpausing of rewards, and handling address overrides and blacklists.

    • Key Functions:

      • injectRewards(uint256): Allows admins with the INJECTION_ROLE to distribute rewards.

      • claimRewards(): Enables token owners to claim their accrued rewards.

      • setRewardsToken(bool, address, uint256): Admins can change the rewards token.

      • pauseRewards() / unpauseRewards(): Admins can pause or resume the claiming of rewards.

    • Privileged Roles:

      • INJECTION_ROLE: Authorized to inject rewards.

      • DEFAULT_ADMIN_ROLE: Grants control over critical functions like setting the rewards token, pausing rewards, and modifying blacklist entries.

    WolferRewards:

    • Purpose: Extends RewardsBase to integrate with the Wolfer NFT ecosystem specifically, interfacing with the DropERC721 contract to manage NFT-related queries.

    • Overrides:

      • Implements nftTotalSupply, nftOwnerOf, nftTokenOfOwnerByIndex, and nftBalanceOf to interact with the Wolfer NFT contract.

    Attributes:

    • Rewards Token:

      • Can be an ERC20 token or native currency.

      • Decimals: Specifies the decimal places for the rewards token.

    • Injections:

      • Records details of each reward injection, including timestamp, amount, and distribution logic.

    • Blacklist:

      • Supports invalidating NFT IDs and address overrides to manage access and ownership.

    Privileged Roles:

    • RewardsBase:

      • INJECTION_ROLE and DEFAULT_ADMIN_ROLE for managing rewards distribution and system configuration.

    • WolferRewards:

      • Inherits roles from RewardsBase with no additional roles specified.

    Events:

    • Emits events for key actions such as reward injections, claims, and system pause/unpause.

    Executive Summary

    Documentation quality

    The total Documentation Quality score is 8 out of 10.

    • Functional requirements are missed.

    • Technical description is provided.

    • Technical flow is not provided

    • NatSpec is sufficient.

    Code quality

    The total Code Quality score is 8 out of 10.

    • Missing best practices.

    • The development environment is configured.

    Test coverage

    Code coverage of the project is 73% (branch coverage).

    • Not all cases coverage with tests.

    Security score

    Upon auditing, the code was found to contain 0 critical, 0 high, 1 medium, and 2 low severity issues, leading to a security score of 10 out of 10.

    All identified issues are detailed in the “Findings” section of this report.

    Summary

    The comprehensive audit of the customer's smart contract yields an overall score of 8.4. This score reflects the combined evaluation of documentation, code quality, test coverage, and security aspects of the project.

    Scoring Methodologyarrow right

    Risks

    Scope Definition and Security Guarantees: The audit does not cover all code in the repository. Contracts outside the audit scope may introduce vulnerabilities, potentially impacting the overall security due to the interconnected nature of smart contracts.

    Dependency on External Logic for Implemented Logic: The implemented RewardsBase logic depends on external contracts not covered by the audit. This reliance introduces risks if these external contracts are compromised or contain vulnerabilities, affecting the audited project's integrity.

    Single Points of Failure and Control: The project is fully or partially centralized, introducing single points of failure and control. This centralization can lead to vulnerabilities in decision-making and operational processes, making the system more susceptible to targeted attacks or manipulation.

    Administrative Key Control Risks: The digital contract architecture relies on administrative keys for critical operations. Centralized control over these keys presents a significant security risk, as compromise or misuse can lead to unauthorized actions or loss of funds.

    Dynamic Array Iteration Gas Limit Risks: The project iterates over large dynamic arrays, which leads to excessive gas costs, risking denial of service due to out-of-gas errors, directly impacting contract usability and reliability.

    Unbounded Loops Without Gas Limit Checks: Loops without explicit gas limit checks result in unfinishable transactions, freezing the function and potentially locking up the contract, affecting user trust and contract reliability.

    Nested Loops in Contract Functions: Nested loops cause rapidly escalating gas costs, making certain functions prohibitively expensive or even unusable, which severely limits contract functionality and user experience.

    Findings

    Code
    ―
    Title
    Status
    Severity
    F-2024-2061Centralized Withdrawal Function Vulnerability
    accepted

    Medium
    F-2024-2024Potential zero division
    fixed

    Low
    F-2024-2023Use Of transfer or send Instead Of call To Send Native Assets
    fixed

    Low
    F-2024-2022Missing checks for address(0)
    mitigated

    Observation
    F-2024-2021Remove hardhat import
    accepted

    Observation
    F-2024-2019Payable Usage Is Unnecessary
    accepted

    Observation
    F-2024-2018Unneeded initializations of uint256 and bool variable to 0/false
    accepted

    Observation
    F-2024-2017TODO Left in the code
    fixed

    Observation
    F-2024-2016Unused structs
    fixed

    Observation
    F-2024-2015Custom Errors in Solidity for Gas Efficiency
    mitigated

    Observation
    1-10 of 12 findings

    Identify vulnerabilities in your smart contracts.

    Appendix 1. Severity Definitions

    When auditing smart contracts, Hacken is using a risk-based approach that considers Likelihood, Impact, Exploitability and Complexity metrics to evaluate findings and score severities.

    Reference on how risk scoring is done is available through the repository in our Github organization:

    Severity

    Description

    Critical
    		Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.

    High
    		High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.

    Medium
    		Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.

    Low
    		Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score.

    • Severity

      Critical

      Description

      Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.

      Severity

      High

      Description

      High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.

      Severity

      Medium

      Description

      Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.

      Severity

      Low

      Description

      Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score.

    Appendix 2. Scope

    The scope of the project includes the following smart contracts from the provided repository:

    Scope Details

    Repositoryhttps://github.com/Presend-DeFi/presend-claiming-tokenomics→
    Commit96bca25875f29f3f8c5494dd09c33175fa5ab734
    Remediationa48f29223e92840ee9f8a5a0c23be99901b4f297
    WhitepaperN/A
    RequirementsN/A
    Technical RequirementsN/A

    Contracts in Scope

    contracts
    RewardsBase.sol - contracts › RewardsBase.sol
    WolferRewards.sol - contracts › WolferRewards.sol

    Disclaimer