Prepared by:
HALBORN
Last Updated 07/03/2025
Date of Engagement: May 29th, 2025 - June 17th, 2025
100% of all REPORTED Findings have been addressed
All findings
18
Critical
0
High
0
Medium
3
Low
5
Informational
10
MAKE engaged Halborn to conduct a security assessment of their CSPR.name contracts on the Casper Network, from May 29th, 2025, to June 16th, 2025. The scope of this assessment was limited to the repository identified by a specific commit hash, with additional details provided in the Scope section of this report.
CSPR.name is a Web3 naming service built on the Casper Network. It enables users to replace complex hexadecimal account identifiers with human-readable names (e.g., smith.cspr), functioning similarly to how Web2 DNS translates IP addresses into domain names.
The team at Halborn assigned a dedicated, full-time security engineer to evaluate the security of the smart contracts. The security engineer possesses advanced expertise in blockchain and smart contract security, with extensive skills in penetration testing, smart-contract hacking, and comprehensive knowledge of multiple blockchain protocols.
The objectives of this assessment are to:
Verify that the contract functionalities operate as intended
Identify potential security vulnerabilities within the contracts
Overall, Halborn identified several areas for improvement to reduce risks and their potential impact, which have been addressed by the MAKE team. The primary recommendations include:
Increment the minted_tokens_count variable within the mint function after each successful token minting.
Enforce strict subdomain validation by verifying that the extracted token_name matches a DNS-label pattern using a regex.
Ensure that the resolved address of the primary name matches the caller’s address to guarantee that only the legitimate owner can set reverse resolution for their address.
Enable overflow checks in release mode to safeguard the expiration logic from potential integer overflows.
Halborn employed a combination of manual code review and automated security testing to ensure a comprehensive, efficient evaluation of the smart contracts. Manual testing aimed to identify logical, procedural, and implementation flaws, while automated testing enhanced coverage and rapidly detected deviations from security best practices. The assessment employed the following phases and tools:
Research into the architecture, purpose, and usage of the protocol.
Manual code review and walkthrough.
Manual assessment of critical Rust variables and functions to identify potential arithmetic vulnerabilities.
Evaluation of cross-contract call controls.
Logical control review based on the overall architecture.
Scanning Rust files for known vulnerabilities using cargo audit.
Integration testing within a local testing environment.
| EXPLOITABILITY METRIC () | METRIC VALUE | NUMERICAL VALUE |
|---|---|---|
| Attack Origin (AO) | Arbitrary (AO:A) Specific (AO:S) | 1 0.2 |
| Attack Cost (AC) | Low (AC:L) Medium (AC:M) High (AC:H) | 1 0.67 0.33 |
| Attack Complexity (AX) | Low (AX:L) Medium (AX:M) High (AX:H) | 1 0.67 0.33 |
| IMPACT METRIC () | METRIC VALUE | NUMERICAL VALUE |
|---|---|---|
| Confidentiality (C) | None (C:N) Low (C:L) Medium (C:M) High (C:H) Critical (C:C) | 0 0.25 0.5 0.75 1 |
| Integrity (I) | None (I:N) Low (I:L) Medium (I:M) High (I:H) Critical (I:C) | 0 0.25 0.5 0.75 1 |
| Availability (A) | None (A:N) Low (A:L) Medium (A:M) High (A:H) Critical (A:C) | 0 0.25 0.5 0.75 1 |
| Deposit (D) | None (D:N) Low (D:L) Medium (D:M) High (D:H) Critical (D:C) | 0 0.25 0.5 0.75 1 |
| Yield (Y) | None (Y:N) Low (Y:L) Medium (Y:M) High (Y:H) Critical (Y:C) | 0 0.25 0.5 0.75 1 |
| SEVERITY COEFFICIENT () | COEFFICIENT VALUE | NUMERICAL VALUE |
|---|---|---|
| Reversibility () | None (R:N) Partial (R:P) Full (R:F) | 1 0.5 0.25 |
| Scope () | Changed (S:C) Unchanged (S:U) | 1.25 1 |
| Severity | Score Value Range |
|---|---|
| Critical | 9 - 10 |
| High | 7 - 8.9 |
| Medium | 4.5 - 6.9 |
| Low | 2 - 4.4 |
| Informational | 0 - 1.9 |
Critical
0
High
0
Medium
3
Low
5
Informational
10
| Security analysis | Risk level | Remediation Date |
|---|---|---|
| Missing Token Count Increment Bypasses Max Supply Limit | Medium | Solved - 06/30/2025 |
| Lack of Subdomain Name Validation | Medium | Solved - 06/30/2025 |
| Users Can Set Unowned Names as Primary in Reverse Resolution | Medium | Solved - 06/30/2025 |
| Integer Overflow in Expiration Logic May Cause Incorrect Reverts or Premature Expirations | Low | Solved - 06/30/2025 |
| Missing Refund Mechanism For Excess CSPR | Low | Solved - 06/30/2025 |
| Lacking Pausability Mechanism | Low | Solved - 06/30/2025 |
| Missing Error Definitions in Contract Schema | Low | Solved - 06/30/2025 |
| Incorrect Access Control in Whitelist Revocation | Low | Solved - 06/30/2025 |
| Double Cleanup of Default Resolver During Token Transfer | Informational | Solved - 06/30/2025 |
| Unnecessary Storage Write on Revoke for Non-Whitelisted Addresses | Informational | Solved - 06/30/2025 |
| Reverse Resolver Allows Unnecessary Primary Name Updates | Informational | Solved - 06/30/2025 |
| Missing Label Validation Allows Registration of Structurally Invalid and Unusable Domains | Informational | Solved - 06/30/2025 |
| Missing Validation Of Contract Addresses | Informational | Solved - 06/30/2025 |
| Unneeded Admin Role Assignment in Registrar Deployment | Informational | Solved - 06/30/2025 |
| Incorrect Naming Can Lead to Logic Errors or Misuse | Informational | Solved - 07/02/2025 |
| Lacking Event Emission | Informational | Solved - 06/30/2025 |
| Inconsistencies In Documentation | Informational | Solved - 06/30/2025 |
| Unnecessary Clone | Informational | Solved - 06/30/2025 |
//Medium
//Medium
//Medium
//Low
//Low
//Low
//Low
//Low
//Informational
//Informational
//Informational
//Informational
//Informational
//Informational
//Informational
//Informational
//Informational
//Informational
Halborn strongly recommends conducting a follow-up assessment of the project either within six months or immediately following any material changes to the codebase, whichever comes first. This approach is crucial for maintaining the project’s integrity and addressing potential vulnerabilities introduced by code modifications.
// Download the full report
MAKE CSPR.name
* Use Google Chrome for best results
** Check "Background Graphics" in the print settings if needed
