Prepared by:
HALBORN
Last Updated Unknown date
Date of Engagement: January 6th, 2025 - January 10th, 2025
Summary
100% of all REPORTED Findings have been addressed
All findings
9
Critical
0
High
1
Medium
0
Low
3
Informational
5
Table of Contents
1. Introduction
CoreDAO engaged Halborn to conduct a comprehensive security assessment of their smart contracts from January 6th to January 10th, 2025, focusing on modifications to the codebase between the commit 551393b and the commit c439750. The review specifically targets changes introduced during these commits, assuming the validity of the pre-existing logic and excluding verification of its security, e.g., input validation of previously existing parameters.
The scope of the security assessment was confined to the smart contracts provided to Halborn, with specific commit hashes and additional details available in the Scope section of this report.
2. Assessment Summary
The team at Halborn assigned a full-time security engineer to assess the security of the smart contracts. The security engineer is a blockchain and smart-contract security expert with advanced penetration testing, smart-contract hacking, and deep knowledge of multiple blockchain protocols.
The purpose of this assessment is to:
Ensure that smart contract functions operate as intended.
Identify potential security issues with the smart contracts.
In summary, Halborn identified some improvements to reduce the likelihood and impact of risks, which were partially addressed by the CoreDAO team. The main ones were the following:
Adjust the remain value when receiving rewards only after confirming that a transfer was successful.Ensure that rewardMap entries are deleted whenever 'rewardUnclaimed' is non-zero, even if 'reward' and 'accStakedAmount' are zero.Allow partial allocations in the receiveRewards function when 'remain' is less than 'toWhiteListValue'.Integrate viewCollectReward function into BitcoinAgent contract if intended for use or remove it to improve code clarity and maintainability.
3. SCOPE
- contracts/BitcoinAgent.sol
- contracts/BitcoinLSTStake.sol
- contracts/BitcoinStake.sol
4. Findings Overview
| Security analysis | Risk level | Remediation |
|---|---|---|
| Unaccounted funds in rewards distribution logic | High | Solved - 01/13/2025 |
| Incomplete reward map cleanup | Low | Risk Accepted - 02/26/2025 |
| Skipping rewards allocation in fund distribution | Low | Risk Accepted - 01/13/2025 |
| Unreachable function due to access restriction | Low | Risk Accepted - 02/25/2025 |
| Incomplete input validation in parameter updates | Informational | Solved - 01/13/2025 |
| Potential inconsistent delegator data handling | Informational | Solved - 01/13/2025 |
| Suboptimal gas usage due to post-increment in loops | Informational | Acknowledged - 01/13/2025 |
| Unused and uncleared storage mapping | Informational | Acknowledged - 01/13/2025 |
| Duplicate functions | Informational | Solved - 01/13/2025 |
Halborn strongly recommends conducting a follow-up assessment of the project either within six months or immediately following any material changes to the codebase, whichever comes first. This approach is crucial for maintaining the project’s integrity and addressing potential vulnerabilities introduced by code modifications.
Table of Contents
// Download the full report
BTC Hardfork - Enhancement / Update
* Use Google Chrome for best results
** Check "Background Graphics" in the print settings if needed