Smart Contract Assessment Audit | Moonwell

Summary

100% of all REPORTED Findings have been addressed

About this report

Assessment Type

Assurance Assessment

Date of Engagement

April 5th, 2022 - June 17th, 2022

Severity Breakdown

3Not Applicable
2Acknowledged
1Risk Accepted
12Solved
18All Findings

Critical0
High0
Medium3
- 2Solved
- 1Risk A.
Low3
- 2N/A
- 1Solved
Informational12
- 9Solved
- 2Ack.
- 1N/A

INTRODUCTION#

Moonwell Finance engaged Halborn to conduct a security audit on their smart contracts beginning on 2022-04-05 and ending on 2022-06-17. The security assessment was scoped to the smart contracts provided to the Halborn team.

AUDIT SUMMARY#

The team at Halborn was provided a week for the engagement and assigned a full-time security engineer to audit the security of the smart contract. The security engineer is a blockchain and smart-contract security expert with advanced penetration testing, smart-contract hacking, and deep knowledge of multiple blockchain protocols.

The purpose of this audit is to:

Ensure that smart contract functions operate as intended.
Identify potential security issues with the smart contracts.

In summary, Halborn identified some security risks that were addressed by the Moonwell Finance team.

TEST APPROACH & METHODOLOGY#

Halborn performed a combination of manual and automated security testing to balance efficiency, timeliness, practicality, and accuracy regarding the scope of the smart contract audit. While manual testing is recommended to uncover flaws in logic, process, and implementation; automated testing techniques help enhance coverage of smart contracts and can quickly identify items that do not follow security best practices. The following phases and associated tools were used throughout the term of the audit:

Research into architecture and purpose.
Smart Contract manual code review and walkthrough.
Graphing out functionality and contract logic/connectivity/functions(solgraph)
Manual Assessment of use and safety for the critical Solidity variables and functions in scope to identify any arithmetic related vulnerability classes.
Dynamic Analysis (ganache-cli, brownie, hardhat).

SCOPE#

\begin{enumerate} \item Moonwell Finance Token Sale Contracts \begin{enumerate} \item Repository: \href{https://github.com/moonwell-fi/moonwell-contracts-private/tree/726dcbaef18670d344fa5621c23c4db0e403583a/contracts/tokensale}{Token Sale} \item Commit ID: \href{https://github.com/moonwell-fi/moonwell-contracts-private/tree/726dcbaef18670d344fa5621c23c4db0e403583a/contracts/tokensale}{726dcbaef18670d344fa5621c23c4db0e403583a} \item New PR : \href{ https://github.com/moonwell-fi/moonwell-contracts-private/pull/43 }{PR} \item New Commit : \href{ https://github.com/moonwell-fi/moonwell-contracts-private/tree/9c51e4860c3f768190036ddcc7dbc4ef3d497c1f/contracts/tokensale }{New Commit} \end{enumerate} \item Out-of-Scope \begin{enumerate} \item test/*.sol \end{enumerate} \end{enumerate}

Out-of-scope: External contract, libraries and financial related attacks.

FIX Commit ID : 762cdc4cd9a8d09f29765f9e143b25af0ebe9720

TAG : artemis-v1

Risk Methodology#

Halborn assesses the severity of findings using either the Common Vulnerability Scoring System (CVSS) framework or the Impact/Likelihood Risk scale, depending on the engagement. CVSS is an industry standard framework for communicating characteristics and severity of vulnerabilities in software. Details can be found in the CVSS Specification Document published by F.I.R.S.T.

Vulnerabilities or issues observed by Halborn scored on the Impact/Likelihood Risk scale are measured by the LIKELIHOOD of a security incident and the IMPACT should an incident occur. This framework works for communicating the characteristics and impacts of technology vulnerabilities. The quantitative model ensures repeatable and accurate measurement while enabling users to see the underlying vulnerability characteristics that were used to generate the Risk scores. For every vulnerability, a risk level will be calculated on a scale of 5 to 1 with 5 being the highest likelihood or impact.

RISK SCALE - LIKELIHOOD

5 - Almost certain an incident will occur.
4 - High probability of an incident occurring.
3 - Potential of a security incident in the long term.
2 - Low probability of an incident occurring.
1 - Very unlikely issue will cause an incident.

RISK SCALE - IMPACT

5 - May cause devastating and unrecoverable impact or loss.
4 - May cause a significant level of impact or loss.
3 - May cause a partial impact or loss to many.
2 - May cause temporary impact or loss.
1 - May cause minimal or un-noticeable impact.

The risk level is then calculated using a sum of these two values, creating a value of 10 to 1 with 10 being the highest level of security risk.

Critical

High

Medium

Low

Informational

10 - CRITICAL
9 - 8 - HIGH
7 - 6 - MEDIUM
5 - 4 - LOW
3 - 1 - VERY LOW AND INFORMATIONAL

Scope#

Out-of-Scope: New features/implementations after the remediation commit IDs.

Assessment Summary & Findings Overview#

Impact x Likelihood

Likelihood

Impact

HAL-01

HAL-04

HAL-05

HAL-02

HAL-03

HAL-06

HAL-07

HAL-08

HAL-09

HAL-10

HAL-11

HAL-12

HAL-13

HAL-14

HAL-15

HAL-16

HAL-17

HAL-18

#	Title	Severity	Score	Status
HAL-01	EXPIRED TOKENS ARE NOT CONSIDERED IN THE VOTING POWER	Medium	4×2	Solved06/16/2022
HAL-02	OLD TOKENS ARE NOT RECOVERABLE WHEN THE NEW TOKEN IS SET	Medium	3×3	Solved04/13/2022
HAL-03	OWNER CAN RESET ALLOCATIONS - DELEGATIONS	Medium	3×3	Risk Accepted
HAL-04	MISSING EVENTS FOR ADMIN ONLY FUNCTIONS THAT CHANGE CRITICAL PARAMETERS	Low	3×1	Not Applicable
HAL-05	UNNEEDED INITIALIZATION OF UINT256 VARIABLES TO 0	Low	3×1	Solved04/13/2022
HAL-06	MISSING ZERO ADDRESS CHECKS	Low	2×2	Not Applicable
HAL-07	USING ++I CONSUMES LESS GAS THAN I+=1 IN LOOPS	Informational	1×1	Solved04/13/2022
HAL-08	CACHING THE LENGTH IN THE FOR LOOPS	Informational	1×1	Solved04/13/2022
HAL-09	REVERT STRING SIZE OPTIMIZATION	Informational	1×1	Acknowledged
HAL-10	MISSING CHECKS FOR NON-ZERO TRANSFER VALUE CALLS	Informational	1×1	Solved04/13/2022
HAL-11	BLOCK WITH GAS LIMIT	Informational	1×1	Acknowledged
HAL-12	EXPERIMENTAL KEYWORD USAGE	Informational	1×1	Solved04/13/2022
HAL-13	UPGRADE AT LEAST PRAGMA 0.8.10	Informational	1×1	Solved04/13/2022
HAL-14	OPEN TODOS	Informational	1×1	Solved06/16/2022
HAL-15	CHANGING FUNCTION VISIBILITY FROM PUBLIC TO EXTERNAL CAN SAVE GAS	Informational	1×1	Solved06/16/2022
HAL-16	DIRECT USAGE OF ECRECOVER ALLOWS SIGNATURE MALLEABILITY	Informational	1×1	Solved06/16/2022
HAL-17	MISSING EVENTS	Informational	1×1	Solved06/16/2022
HAL-18	OPTIMIZE UNSIGNED INTEGER COMPARISON	Informational	1×1	Not Applicable

UNNEEDED INITIALIZATION OF UINT256 VARIABLES TO 0

Low

Impact: 3 / Likelihood: 1

Description

Recommendation

Remediation Comment

HAL-06Not Applicable

MISSING ZERO ADDRESS CHECKS

Low

9. Automated Testing#

Disclaimer#

Halborn strongly recommends conducting a follow-up assessment of the project either within six months or immediately following any material changes to the codebase, whichever comes first. This approach is crucial for maintaining the project’s integrity and addressing potential vulnerabilities introduced by code modifications.