Shiboo Token - Simplified - Casper Association

1. Introduction

Casper engaged Halborn to conduct a security assessment of the Shiboo Token contract, as well as to investigate suspicious activity that developers had detected in Mainnet transactions, beginning April 11th, 2024 and ending April 26th, 2024.

Shiboo Token is a new digital asset with a total and max supply of 10 billion tokens. Within this allocation, 5% is securely held in the Treasury, while the remaining 95% is dedicated to the Initial Liquidity Pool. The project team is committed to providing initial liquidity, employing a 5% sell tax mechanism to enhance liquidity and potentially decrease the token supply through burns.

2. Assessment Summary

The team at Halborn assigned a full-time security engineer to verify the security of the smart contract. The security engineer is a blockchain and smart-contract security expert with advanced penetration testing, smart-contract hacking, and deep knowledge of multiple blockchain protocols.

The purpose of this assessment is to:

• Ensure that smart contract functions operate as intended.

• Identify potential security issues with the smart contracts.

In summary, Halborn identified some improvements to reduce the likelihood and impact of risks, which have been acknowledged by the Shiboo team. The main ones are the following: 

• The token has mint functionality disabled, so all code related to it can be removed to save gas.

• The transfer_from function should emit the TransferFrom event, not the Transfer one.

• The access control of the burn function is not necessary since the caller address is compared to with an input argument entered by the user.

• The initial_admin key is initialized twice, remove one of them to save gas.

3. Test Approach and Methodology

Halborn performed a combination of the manual view of the code and automated security testing to balance efficiency, timeliness, practicality, and accuracy regarding the scope of the smart contract assessment. While manual testing is recommended to uncover flaws in logic, process, and implementation, automated testing techniques help enhance the coverage of smart contracts. They can quickly identify items that do not follow security best practices. The following phases and associated tools were used throughout the term of the assessment:

• Research into architecture, purpose, and use of the platform.

• Manual code read and walk through.

• Manual Assessment of use and safety for the critical Rust variables and functions in scope to identify any arithmetic related vulnerability classes.

• Cross contract call controls.

• Architecture related logical controls.

• Scanning of Rust files for vulnerabilities.(cargo audit)

• Deployment to testnet through casper-client.

• Comprehensive review of transactions through the CPSR live explorer.

  
  

4. Suspicious activity investigation

The Shiboo token assessment was contracted to Halborn on special terms. Casper communicated that they found suspicious activity in relation to the Shiboo token, so there was an urgent need to assess the code and the current situation. The Shiboo team was concerned about a transaction where it appeared that tax on sell was being bypassed and also a situation where a user was running a script every few minutes to sell.

After evaluating the source code of the Shiboo token, Halborn concluded that there were no security issues with the token itself, but after analyzing transactions on the Mainnet, it was found a lot of activity related to the Shiboo token and the Friendly Market, as this token is listed on it, so Halborn strongly recommended analyzing the source code of the current version of Friendly Market deployed on Mainnet to validate the transactions between the two contracts.

However, the Friendly Market team was not able to provide the source code of the current commit deployed on mainnet. At this point, the analysis of suspicious activity has been based on the transactions tracked in the explorer and the source code of the Shiboo token.

The following sections will explain the investigation that has been done on the transactions that were flagged by the Shiboo team, some other suspicious transactions found on the blockchain and the corresponding conclusions.

Transaction suspected of bypass tax on sell

The first transaction analyzed was suspected of evading the sales tax. The Shiboo token applies fees only when transferring to specific contracts, which seemed to be the concern.

Initial exploration suggested a simple token transfer, but further analysis showed that the transaction involved a Session Code, which operates like a script containing various contract calls. Although the full source code of this Session Code isn't available, the events logged indicate that the Friendly Market contract was used to execute a transaction.

Reviewing the transaction logs, the arguments suggested that it executed the Friendly Market entry point named swap_exact_tokens_for_cspr_supporting_fee_on_transfer_tokens. Analyzing these arguments and the events logged, the following conclusions were drawn:

• The session code executed a transaction at the Friendly Market entry point.

• The transfer tax applied by the Shiboo token was correctly deducted, confirming that the transfer tax mechanism is functioning as expected.

  
  

Without access to the Friendly Market source code, it is impossible to confirm if there are issues with the transactions since the logic of the functions applied is unknown. The overall functionality of the swapping process seems adequate and correct.

Set of transactions in which a user executes a sales script every few minutes

The Shiboo development team was also concerned about frequent transactions from a single user, who appeared to be extracting liquidity at regular intervals.

Similar to the previous case, these transactions involved Session Code executions. The arguments used in these transactions indicated that the user was interacting with the Friendly Market’s remove_liquidity_cspr entry point to burn LP tokens and retrieve the native CSPR token. The logs showed no evidence of malicious activity, though it was noted that an approval event occurred twice with the same details and an unusually high approval amount.

However, as mentioned above, without having access to the source code of the session code executed by the user and without knowing all the logic implemented by the Friendly Market functions, it cannot be stated that any malicious activity is occurring in such contracts since the frequency of execution cannot be evidence of malicious activity with the information available to us.

Other suspicious activity

As with other blockchain technologies, due to the significant amounts of money involved, blockchain environments are attractive targets for hackers. Since transactions are public, attempts to exploit or bypass security mechanisms can sometimes be observed. An example related to the Shiboo token involved a transaction where a user attempted to modify the fee_recipient address to their own.

Fortunately, the token code is robust enough to prevent such attacks, triggering an error that only allows the legitimate fee recipient to make such changes.

Conclusion

The investigation did not find any definitive evidence of security breaches or malicious activity in the analyzed transactions. However, due to the limitations in accessing the full source code of relevant contracts, some uncertainties remain. Further review of the Friendly Market’s code is recommended to fully ensure the integrity of the transactions.