Smart Contract Assessment - Moonwell

1. INTRODUCTION

Moonwell Finance engaged Halborn to conduct a security audit on their Governance smart contracts beginning on September 18th, 2022 and ending on September 26th, 2022. The security assessment was scoped to the smart contracts provided to the Halborn Team.

2. AUDIT SUMMARY

The Team at Halborn was provided one week for the engagement and assigned a full-time security engineer to audit the security of the smart contract. The security engineer is a blockchain and smart-contract security expert with advanced penetration testing, smart-contract hacking, and deep knowledge of multiple blockchain protocols.

The purpose of this audit is to:

• Ensure that smart contract functions operate as intended.

• Identify potential security issues with the smart contracts.

In summary, Halborn identified some security risks that were addressed by the Moonwell team.

3. TEST APPROACH & METHODOLOGY

Halborn performed a combination of manual and automated security testing to balance efficiency, timeliness, practicality, and accuracy regarding the scope of the smart contract audit. While manual testing is recommended to uncover flaws in logic, process, and implementation; automated testing techniques help enhance coverage of smart contracts and can quickly identify items that do not follow security best practices. The following phases and associated tools were used throughout the term of the audit:

• Research into architecture and purpose.

• Smart Contract manual code review and walkthrough.

• Graphing out functionality and contract logic/connectivity/functions(solgraph).

• Manual Assessment of use and safety for the critical Solidity variables and functions in scope to identify any arithmetic related vulnerability classes.

• Static Analysis of security for scoped contract, and imported functions.(Slither)

• Dynamic Analysis (ganache-cli, brownie, hardhat).

4. SCOPE

\begin{enumerate} \item Moonwell Finance Smart Contracts \begin{enumerate} \item PR 80: \href{https://github.com/moonwell-fi/moonwell-contracts-private/pull/80}{Moonwell Finance - Moonwell Core} \end{enumerate} \end{enumerate}

• INSCOPE COMMIT ID :

d248cc9a4fc08849f0a5f5d34560f7998b182d4b

FIX COMMIT ID :

• Apollo v2 - c7da88a3fe3f0062d8a83ba808b648f1da369fec

TAG :

• apollo-v2