Smart Contract Assessment - Moonwell

1. INTRODUCTION

Moonwell Finance engaged Halborn to conduct a security audit on their Governance & Timelock smart contracts beginning on August 10th, 2022 and ending on August 17th, 2022. The security assessment was scoped to the smart contracts provided to the Halborn team.

2. AUDIT SUMMARY

The team at Halborn was provided one week for the engagement and assigned a full-time security engineer to audit the security of the smart contract. The security engineer is a blockchain and smart-contract security expert with advanced penetration testing, smart-contract hacking, and deep knowledge of multiple blockchain protocols.

The purpose of this audit is to:

• Ensure that smart contract functions operate as intended.

• Identify potential security issues with the smart contracts.

In summary, Halborn identified some security risks that were addressed by the Moonwell Finance team.

3. TEST APPROACH & METHODOLOGY

Halborn performed a combination of manual and automated security testing to balance efficiency, timeliness, practicality, and accuracy regarding the scope of the smart contract audit. While manual testing is recommended to uncover flaws in logic, process, and implementation; automated testing techniques help enhance coverage of smart contracts and can quickly identify items that do not follow security best practices. The following phases and associated tools were used throughout the term of the audit:

• Research into architecture and purpose.

• Smart Contract manual code review and walkthrough.

• Graphing out functionality and contract logic/connectivity/functions(solgraph)

• Manual Assessment of use and safety for the critical Solidity variables and functions in scope to identify any arithmetic related vulnerability classes.

• Static Analysis of security for scoped contract, and imported functions.(Slither)

• Dynamic Analysis (ganache-cli, brownie, hardhat).

4. SCOPE

\begin{enumerate} \item Moonwell Finance Smart Contracts \begin{enumerate} \item PR 60: \href{https://github.com/moonwell-fi/moonwell-contracts-private/pull/60}{Moonwell Finance - Moonwell Core} \item PR 66: \href{https://github.com/moonwell-fi/moonwell-contracts-private/pull/66}{Moonwell Finance - Moonwell Core} \item PR 67: \href{https://github.com/moonwell-fi/moonwell-contracts-private/pull/67}{Moonwell Finance - Moonwell Core} \item PR 68: \href{https://github.com/moonwell-fi/moonwell-contracts-private/pull/68}{Moonwell Finance - Moonwell Core} \item PR 70: \href{https://github.com/moonwell-fi/moonwell-contracts-private/pull/70}{Moonwell Finance - Moonwell Core} \item PR 71: \href{https://github.com/moonwell-fi/moonwell-contracts-private/pull/71}{Moonwell Finance - Moonwell Core} \end{enumerate} \end{enumerate}

FIX COMMIT ID :

• Artemis v2 - 4e8bec5926339106c225d0f85120ba182e52f2dd

TAG :

• artemis-v2