Prepared by:
HALBORN
Last Updated 07/30/2025
Date of Engagement: June 25th, 2025 - June 30th, 2025
100% of all REPORTED Findings have been addressed
All findings
1
Critical
0
High
0
Medium
0
Low
0
Informational
1
LucidLabs
engaged our security analysis team to conduct a comprehensive security assessment of their smart contract ecosystem. The primary objective was to thoroughly evaluate the security architecture of the smart contracts to identify vulnerabilities, assess existing security measures, and provide actionable recommendations to enhance both the security and operational effectiveness of their smart contract framework. Our assessment was strictly limited to the provided smart contracts, ensuring a focused and exhaustive analysis of their security features.
Our engagement with LucidLabs
spanned a 2 day period, during which we assigned a full-time security engineer with extensive experience in blockchain security, advanced penetration testing skills, and deep knowledge of various blockchain protocols. The objectives of this assessment were to:
- Verify the correct functionality of the smart contract operations.
- Identify potential security vulnerabilities within the smart contracts.
- Provide recommendations to improve the security and efficiency of the smart contracts.
Our testing strategy combined manual and automated techniques to ensure a comprehensive evaluation. Manual testing was essential for detecting logical and implementation flaws, while automated testing provided broad code coverage and rapid identification of common vulnerabilities. The testing process included:
- A detailed review of the smart contracts' architecture and intended functionality.
- Comprehensive manual code reviews and walkthroughs.
- Functional and connectivity analysis using tools such as Solgraph.
- Customized script-based manual testing and testnet deployment using Foundry.
This executive summary highlights the key findings and recommendations from our security assessment of the LucidLabs
smart contract ecosystem. By addressing the identified issues and implementing the recommended improvements, LucidLabs
can significantly enhance the security, reliability, and trustworthiness of its smart contract platform.
EXPLOITABILITY METRIC () | METRIC VALUE | NUMERICAL VALUE |
---|---|---|
Attack Origin (AO) | Arbitrary (AO:A) Specific (AO:S) | 1 0.2 |
Attack Cost (AC) | Low (AC:L) Medium (AC:M) High (AC:H) | 1 0.67 0.33 |
Attack Complexity (AX) | Low (AX:L) Medium (AX:M) High (AX:H) | 1 0.67 0.33 |
IMPACT METRIC () | METRIC VALUE | NUMERICAL VALUE |
---|---|---|
Confidentiality (C) | None (I:N) Low (I:L) Medium (I:M) High (I:H) Critical (I:C) | 0 0.25 0.5 0.75 1 |
Integrity (I) | None (I:N) Low (I:L) Medium (I:M) High (I:H) Critical (I:C) | 0 0.25 0.5 0.75 1 |
Availability (A) | None (A:N) Low (A:L) Medium (A:M) High (A:H) Critical (A:C) | 0 0.25 0.5 0.75 1 |
Deposit (D) | None (D:N) Low (D:L) Medium (D:M) High (D:H) Critical (D:C) | 0 0.25 0.5 0.75 1 |
Yield (Y) | None (Y:N) Low (Y:L) Medium (Y:M) High (Y:H) Critical (Y:C) | 0 0.25 0.5 0.75 1 |
SEVERITY COEFFICIENT () | COEFFICIENT VALUE | NUMERICAL VALUE |
---|---|---|
Reversibility () | None (R:N) Partial (R:P) Full (R:F) | 1 0.5 0.25 |
Scope () | Changed (S:C) Unchanged (S:U) | 1.25 1 |
Severity | Score Value Range |
---|---|
Critical | 9 - 10 |
High | 7 - 8.9 |
Medium | 4.5 - 6.9 |
Low | 2 - 4.4 |
Informational | 0 - 1.9 |
Critical
0
High
0
Medium
0
Low
0
Informational
1
Security analysis | Risk level | Remediation Date |
---|---|---|
Inadequate role separation for pause and unpause functions | Informational | Acknowledged - 07/09/2025 |
//
The LTokenUpgradeable
contract implements a flawed role-based access control system for the pause and unpause functionality. Both the pause()
and unpause()
functions in the contract are protected by the same PAUSE_ROLE
, which creates a significant security vulnerability in the access control design.
During contract initialization, the same address (_owner
) is assigned both the DEFAULT_ADMIN_ROLE
and PAUSE_ROLE
roles. This design allows any account with the PAUSE_ROLE
to both pause and unpause the contract, eliminating the security benefits of having separate controls for these critical operations.
The pause functionality is particularly critical for this contract as it affects all token transfer operations through the _beforeTokenTransfer
hook, which reverts all transfers when the contract is paused. This means that any account with the PAUSE_ROLE
can effectively freeze all token transfers and then immediately resume them, creating a potential attack vector for malicious actors who gain access to this role.
The contract should implement separate roles for pause and unpause operations to enhance security and reduce the attack surface. A recommended approach would be to create distinct roles such as PAUSE_ROLE
and UNPAUSE_ROLE
, where the pause role could be granted to emergency responders or security teams, while the unpause role should be restricted to a smaller set of trusted administrators.
ACKNOWLEDGED: The LucidLabs team acknowledged this finding.
Halborn strongly recommends conducting a follow-up assessment of the project either within six months or immediately following any material changes to the codebase, whichever comes first. This approach is crucial for maintaining the project’s integrity and addressing potential vulnerabilities introduced by code modifications.
// Download the full report
Demos Contract V1 PR16
* Use Google Chrome for best results
** Check "Background Graphics" in the print settings if needed