CMTAT Audit | CMTA | Halborn Audit Reports

Summary

100% of all REPORTED Findings have been addressed

About this report

Assessment Type

Assurance Assessment

Date of Engagement

July 1st, 2025 - July 9th, 2025

Source Code

CMTAT

Assessed Commit ID

04dad82

Severity Breakdown

1Future Release
3Acknowledged
1Risk Accepted
6Solved
11All Findings

Critical0
High0
Medium0
Low2
- 1F. Release
- 1Risk A.
Informational9
- 3Ack.
- 6Solved

Introduction#

Taurus engaged Halborn to perform a security assessment of their smart contracts from July 1st, 2025, to July 9th, 2025. The assessment scope was limited to the smart contracts provided to Halborn. Commit hashes and additional details are available in the Scope section of this report.

The Taurus codebase in scope consists of a Solidity implementation of the CMTAT security token framework, featuring modular compliance and technical capabilities for regulated financial assets on EVM-compatible blockchains, featuring compliance controls and upgradeability.

Assessment Summary#

Halborn was allocated 7 days for this engagement and assigned 1 full-time security engineer to conduct a comprehensive review of the smart contracts within scope. The engineer is an expert in blockchain and smart contract security, with advanced skills in penetration testing and smart contract exploitation, as well as extensive knowledge of multiple blockchain protocols.

The objectives of this assessment were to:

Identify potential security vulnerabilities within the smart contracts.
Verify that the smart contract functionality operates as intended.

In summary, Halborn identified several areas for improvement to reduce the likelihood and impact of potential risks, which were partially addressed by the Taurus team. The primary recommendations were as follows:

Modify the _canMintBurnByModule() function to respect the paused state.
Modify the _forcedTransfer() function to handle allowances in a safe and predictable manner.
Lock the pragma version to the same version used during development and testing.

Test Approach and Methodology#

Halborn conducted a combination of manual code review and automated security testing to balance efficiency, timeliness, practicality, and accuracy within the scope of this assessment. While manual testing is crucial for identifying flaws in logic, processes, and implementation, automated testing enhances coverage of smart contracts and quickly detects deviations from established security best practices.

The following phases and associated tools were employed throughout the term of the assessment:

Research into the platform's architecture, purpose and use.
Manual code review and walkthrough of smart contracts to identify any logical issues.
Comprehensive assessment of the safety and usage of critical Solidity variables and functions within scope that could lead to arithmetic-related vulnerabilities.
Local testing using custom scripts (Foundry).
Fork testing against main networks (Foundry).
Static security analysis of scoped contracts, and imported functions (Slither).

Caveats#

After the initial assessment, Taurus reported an additional compliance issue affecting batch operations. Halborn performed a post-assessment review at commit 198d019 to verify the fixes, and confirmed that the issue has been addressed at that commit.

Risk Methodology#

Every vulnerability and issue observed by Halborn is ranked based on two sets of Metrics and a Severity Coefficient. This system is inspired by the industry standard Common Vulnerability Scoring System.

The two Metric sets are: Exploitability and Impact. Exploitability captures the ease and technical means by which vulnerabilities can be exploited and Impact describes the consequences of a successful exploit.

The Severity Coefficients is designed to further refine the accuracy of the ranking with two factors: Reversibility and Scope. These capture the impact of the vulnerability on the environment as well as the number of users and smart contracts affected.

The final score is a value between 0-10 rounded up to 1 decimal place and 10 corresponding to the highest security risk. This provides an objective and accurate rating of the severity of security vulnerabilities in smart contracts.

The system is designed to assist in identifying and prioritizing vulnerabilities based on their level of risk to address the most critical issues in a timely manner.

5.1 EXPLOITABILITY

Attack Origin (AO):

Captures whether the attack requires compromising a specific account.

Attack Cost (AC):

Captures the cost of exploiting the vulnerability incurred by the attacker relative to sending a single transaction on the relevant blockchain. Includes but is not limited to financial and computational cost.

Attack Complexity (AX):

Describes the conditions beyond the attacker’s control that must exist in order to exploit the vulnerability. Includes but is not limited to macro situation, available third-party liquidity and regulatory challenges.

Metrics:

EXPLOITABILITY METRIC ( $m_e$ )	METRIC VALUE	NUMERICAL VALUE
Attack Origin (AO)	Arbitrary (AO:A)	1
Attack Origin (AO)	Specific (AO:S)	0.2
Attack Cost (AC)	Low (AC:L)	1
	Medium (AC:M)	0.67
	High (AC:H)	0.33
Attack Complexity (AX)	Low (AX:L)	1
	Medium (AX:M)	0.67
	High (AX:H)	0.33

Exploitability

E

is calculated using the following formula:

$E = \prod m_e$

5.2 IMPACT

Confidentiality (C):

Measures the impact to the confidentiality of the information resources managed by the contract due to a successfully exploited vulnerability. Confidentiality refers to limiting access to authorized users only.

Integrity (I):

Measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of data stored and/or processed on-chain. Integrity impact directly affecting Deposit or Yield records is excluded.

Availability (A):

Measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability. This metric refers to smart contract features and functionality, not state. Availability impact directly affecting Deposit or Yield is excluded.

Deposit (D):

Measures the impact to the deposits made to the contract by either users or owners.

Yield (Y):

Measures the impact to the yield generated by the contract for either users or owners.

Metrics:

IMPACT METRIC ( $m_I$ )	METRIC VALUE	NUMERICAL VALUE
Confidentiality (C)	None (C:N)	0
	Low (C:L)	0.25
	Medium (C:M)	0.5
	High (C:H)	0.75
	Critical (C:C)	1
Integrity (I)	None (I:N)	0
	Low (I:L)	0.25
	Medium (I:M)	0.5
	High (I:H)	0.75
	Critical (I:C)	1
Availability (A)	None (A:N)	0
	Low (A:L)	0.25
	Medium (A:M)	0.5
	High (A:H)	0.75
	Critical (A:C)	1
Deposit (D)	None (D:N)	0
	Low (D:L)	0.25
	Medium (D:M)	0.5
	High (D:H)	0.75
	Critical (D:C)	1
Yield (Y)	None (Y:N)	0
	Low (Y:L)	0.25
	Medium (Y:M)	0.5
	High (Y:H)	0.75
	Critical (Y:C)	1

Impact

I

is calculated using the following formula:

$I = max(m_I) + \frac{\sum{m_I} - max(m_I)}{4}$

5.3 SEVERITY COEFFICIENT

Reversibility (R):

Describes the share of the exploited vulnerability effects that can be reversed. For upgradeable contracts, assume the contract private key is available.

Scope (S):

Captures whether a vulnerability in one vulnerable contract impacts resources in other contracts.

Metrics:

SEVERITY COEFFICIENT ( $C$ )	COEFFICIENT VALUE	NUMERICAL VALUE
Reversibility ( $r$ )	None (R:N)	1
	Partial (R:P)	0.5
	Full (R:F)	0.25
Scope ( $s$ )	Changed (S:C)	1.25
Scope ( $s$ )	Unchanged (S:U)	1

Severity Coefficient

C

is obtained by the following product:

$C = rs$

The Vulnerability Severity Score

S

is obtained by:

$S = min(10, EIC * 10)$

The score is rounded up to 1 decimal places.

Critical	High	Medium	Low	Informational
9 - 10	7 - 8.9	4.5 - 6.9	2 - 4.4	0 - 1.9

Scope#

(a) Repository:CMTAT

(b) Assessed Commit ID:04dad821f2adc29e323d89820046a39cf76fad1b

71 files

contracts

71 files

deployment

13 files

allowlist

2 files

CMTATStandaloneAllowlist.sol

solidity

CMTATUpgradeableAllowlist.sol

solidity

debt

2 files

CMTATStandaloneDebt.sol

solidity

CMTATUpgradeableDebt.sol

solidity

ERC1363

2 files

CMTATStandaloneERC1363.sol

solidity

CMTATUpgradeableERC1363.sol

solidity

ERC7551

2 files

contracts71 files

deployment13 files

allowlist2 files

CMTATStandaloneAllowlist.solsolidity

CMTATUpgradeableAllowlist.solsolidity

debt2 files

CMTATStandaloneDebt.solsolidity

CMTATUpgradeableDebt.solsolidity

ERC13632 files

CMTATStandaloneERC1363.solsolidity

CMTATUpgradeableERC1363.solsolidity

ERC75512 files

CMTATStandaloneERC7551.solsolidity

CMTATUpgradeableERC7551.solsolidity

light2 files

CMTATStandaloneLight.solsolidity

CMTATUpgradeableLight.solsolidity

CMTATStandalone.solsolidity

CMTATUpgradeable.solsolidity

CMTATUpgradeableUUPS.solsolidity

interfaces18 files

engine4 files

IDebtEngine.solsolidity

IDocumentEngine.solsolidity

IRuleEngine.solsolidity

ISnapshotEngine.solsolidity

modules4 files

IAllowlistModule.solsolidity

IDebtModule.solsolidity

IDocumentEngineModule.solsolidity

ISnapshotEngineModule.solsolidity

technical4 files

ICMTATConstructor.solsolidity

IERC20Allowance.solsolidity

IERC7802.solsolidity

IMintBurnToken.solsolidity

tokenization6 files

draft-IERC1404.solsolidity

draft-IERC1643.solsolidity

draft-IERC1643CMTAT.solsolidity

draft-IERC7551.solsolidity

ICMTAT.solsolidity

IERC3643Partial.solsolidity

libraries1 file

Errors.solsolidity

modules39 files

internal7 files

common1 file

EnforcementModuleLibrary.solsolidity

AllowlistModuleInternal.solsolidity

EnforcementModuleInternal.solsolidity

ERC20BurnModuleInternal.solsolidity

ERC20EnforcementModuleInternal.solsolidity

ERC20MintModuleInternal.solsolidity

ValidationModuleRuleEngineInternal.solsolidity

wrapper21 files

controllers2 files

ValidationModule.solsolidity

ValidationModuleAllowlist.solsolidity

core7 files

BaseModule.solsolidity

EnforcementModule.solsolidity

ERC20BaseModule.solsolidity

ERC20BurnModule.solsolidity

ERC20MintModule.solsolidity

PauseModule.solsolidity

ValidationModuleCore.solsolidity

extensions6 files

ValidationModule2 files

ValidationModuleERC1404.solsolidity

ValidationModuleRuleEngine.solsolidity

DocumentEngineModule.solsolidity

ERC20EnforcementModule.solsolidity

ExtraInformationModule.solsolidity

SnapshotEngineModule.solsolidity

options5 files

AllowlistModule.solsolidity

DebtEngineModule.solsolidity

DebtModule.solsolidity

ERC2771Module.solsolidity

ERC7551Module.solsolidity

security1 file

AccessControlModule.solsolidity

0_CMTATBaseCommon.solsolidity

0_CMTATBaseCore.solsolidity

0_CMTATBaseGeneric.solsolidity

1_CMTATBaseAllowlist.solsolidity

1_CMTATBaseRuleEngine.solsolidity

2_CMTATBaseDebt.solsolidity

2_CMTATBaseERC1404.solsolidity

3_CMTATBaseERC20CrossChain.solsolidity

4_CMTATBaseERC2771.solsolidity

5_CMTATBaseERC1363.solsolidity

5_CMTATBaseERC7551.solsolidity

Out-of-Scope:Third party dependencies and economic attacks.

067244a0801554e2c2a7512573d005e450ffa765 86dbd2d0151cfd9825f477bbcbc9848fd69c24c1 4d0a72f4646a10293cc11f2f1dbc666798acc054 6b1c32e7dd1b7435ea7b829d1a684f22b80ad113 52e1106bc807057b5b367476661c8090e2b0aae2 f6021de5102172584816d8015e9d4c32f3e4ef68

Out-of-Scope: New features/implementations after the remediation commit IDs.

Assessment Summary & Findings Overview#

#	Title	Severity	Score	Status
HAL-01	Minting and burning operations bypass the pause mechanism	Low	2.5	Future Release07/16/2025
HAL-02	Insufficient allowance validation during forced transfers	Low	2.0	Risk Accepted07/16/2025
HAL-03	Floating pragma	Informational	0.8	Acknowledged07/16/2025
HAL-04	Misleading restriction code returned for deactivated contract	Informational	0.6	Solved07/16/2025
HAL-05	Commented functionality	Informational	0.0	Solved07/16/2025
HAL-06	Typos	Informational	0.0	Solved07/16/2025
HAL-07	Public functions not called within contracts	Informational	0.0	Acknowledged07/16/2025
HAL-08	Misleading comment regarding frozen balance calculation	Informational	0.0	Solved07/16/2025
HAL-09	Inconsistent method of calling inherited functions	Informational	0.0	Solved07/16/2025
HAL-10	Lack of named mappings	Informational	0.0	Solved07/16/2025
HAL-11	Unused file	Informational	0.0	Acknowledged07/16/2025

Findings & Tech Details#

HAL-01Future Release

Minting and burning operations bypass the pause mechanism

Low

2.5AO:S/AC:L/AX:L/R:N/S:U/C:N/A:N/I:C/D:C/Y:N

Description

Recommendation

Remediation Comment

HAL-02Risk Accepted

Insufficient allowance validation during forced transfers

Low

2.0AO:S/AC:L/AX:L/R:N/S:U/C:N/A:N/I:N/D:C/Y:N

Description

Recommendation

Remediation Comment

HAL-03Acknowledged

Floating pragma

Informational

0.8AO:A/AC:L/AX:H/R:N/S:U/C:N/A:N/I:L/D:N/Y:N

Description

Recommendation

Remediation Comment

HAL-04Solved

Misleading restriction code returned for deactivated contract

Informational

0.6AO:A/AC:H/AX:M/R:N/S:U/C:N/A:N/I:L/D:N/Y:N

Description

Recommendation

Remediation Comment

Addressed in:

067244a0801554e2c2a7512573d005e450ffa765

HAL-05Solved

Commented functionality

Informational

0.0AO:A/AC:L/AX:L/R:N/S:U/C:N/A:N/I:N/D:N/Y:N

Description

Recommendation

Remediation Comment

Addressed in:

86dbd2d0151cfd9825f477bbcbc9848fd69c24c1

HAL-06Solved

Typos

Informational

0.0AO:A/AC:L/AX:L/R:N/S:U/C:N/A:N/I:N/D:N/Y:N

Description

Recommendation

Remediation Comment

Addressed in:

4d0a72f4646a10293cc11f2f1dbc666798acc054

HAL-07Acknowledged

Public functions not called within contracts

Informational

0.0AO:A/AC:L/AX:L/R:N/S:U/C:N/A:N/I:N/D:N/Y:N

Description

Recommendation

Remediation Comment

HAL-08Solved

Misleading comment regarding frozen balance calculation

Informational

0.0AO:A/AC:L/AX:L/R:N/S:U/C:N/A:N/I:N/D:N/Y:N

Description

Recommendation

Remediation Comment

Addressed in:

6b1c32e7dd1b7435ea7b829d1a684f22b80ad113

HAL-09Solved

Inconsistent method of calling inherited functions

Informational

0.0AO:A/AC:L/AX:L/R:N/S:U/C:N/A:N/I:N/D:N/Y:N

Description

Recommendation

Remediation Comment

Addressed in:

52e1106bc807057b5b367476661c8090e2b0aae2

HAL-10Solved

Lack of named mappings

Informational

0.0AO:A/AC:L/AX:L/R:N/S:U/C:N/A:N/I:N/D:N/Y:N

Description

Recommendation

Remediation Comment

Addressed in:

f6021de5102172584816d8015e9d4c32f3e4ef68

HAL-11Acknowledged

Unused file

Informational

0.0AO:A/AC:L/AX:L/R:N/S:U/C:N/A:N/I:N/D:N/Y:N

Description

Recommendation

Remediation Comment

9. Automated Testing#

Disclaimer#

Halborn strongly recommends conducting a follow-up assessment of the project either within six months or immediately following any material changes to the codebase, whichever comes first. This approach is crucial for maintaining the project’s integrity and addressing potential vulnerabilities introduced by code modifications.