Website: voltara.ca
Category: Renewable energy data / Blockchain infrastructure
Technology: Solidity, Polygon, Oracle-Agnostic Interface (incl. Chainlink Functions)
Focus areas: Energy-data verification, reward issuance, project registry, treasury controls, NFT certificates
Audit: Hacken smart contract security assessment
Report: Hacken smart contract audit report
Overview
Hacken works with organisations across the Canadian innovation ecosystem to support the security of digital technologies, including projects backed by public innovation programmes. Voltara’s security assessment was supported through Alberta Innovates’ Micro Voucher Program, an initiative designed to help Alberta-based innovators access specialised expertise and services. More funding opportunities can be found via the link.
With support through the programme, Voltara engaged Hacken to assess six Solidity smart contracts deployed on Polygon. The assessment examined how energy data is recorded and processed, how rewards are issued and distributed, and how administrative and treasury controls operate across the protocol.
For Hacken, work with Canadian innovation programmes and technology companies is part of the wider effort to make digital infrastructure safer for real-world applications.
About Voltara
Voltara uses verified energy data to connect renewable-energy activity with on-chain records and token rewards. Its smart contract system includes the Proof-of-Green-Work (PoGW) protocol, VTRX token, project registry, treasury, and certificate contracts. The protocol is designed to help address greenwashing by making emissions data publicly accessible on-chain, including for remote communities that generate the data, rather than limiting access to auditors and investors.
Energy readings can be supplied through authorised oracle-agnostic data sources supporting off-chain data verification.
Audit Approach
Hacken reviewed the six-contract Solidity codebase, including the version submitted for assessment and the subsequent remediation changes.
The review covered reward issuance, energy-data processing, project registration, certificate issuance, treasury operations, administrative permissions, emergency controls, input validation and event handling.
The assessment also considered how the contracts interact with each other. This was important because controls in one contract can affect how rewards, project data and administrative actions are handled elsewhere in the system.
The audit identified 30 findings, covering issues from reward and access controls to data validation and operational safeguards.
Key Findings
The audit identified issues across several areas of the protocol, including reward issuance, project configuration, emergency controls, and treasury operations.
The most significant findings concerned how VTRX rewards could be issued under different contracts. The implementation was changed to establish a single reward-minting path and remove the possibility of inconsistent reward distribution or duplicate issuance.
The audit also identified weaknesses in project and energy-data validation. These were addressed by separating project registration from updates, adding validation checks and placing limits on submitted energy data.
Administrative and emergency controls were strengthened as well. Pause mechanisms were extended across relevant contracts, configuration controls were improved, and larger treasury withdrawals were placed behind a 48-hour timelock.
A further change addressed the precision of energy tracking, allowing smaller energy sessions to be recorded more accurately.
Audit Results
The final report records 30 findings:
All 30 findings were fixed and resolved.
Key changes delivered:
- VTRX issuance was consolidated into a single contract, removing inconsistent reward distribution and duplicate-minting risks
- Project registration and updates were separated, with additional checks on project and energy-data inputs
- Emergency pause controls were extended across the relevant contracts while preserving the ability to revoke fraudulent tokens
- Larger treasury withdrawals were placed behind a 48-hour timelock
- Energy tracking was updated to record smaller energy sessions with greater precision
Read the full audit report: https://hacken.io/audits/voltara/
