Summary
100% of all REPORTED Findings have been addressed
- 0Acknowledged
- 0Risk Accepted
- 11Solved
- 11All Findings
- Critical0
- High1
- 1Solved
- Medium4
- 4Solved
- Low4
- 4Solved
- Informational2
- 2Solved
Introduction#
Prodigy engaged Halborn to conduct a security assessment on their smart contracts revisions beginning on 10/10/2024 and ending on 10/14/2024. The security assessment was scoped to the smart contracts provided to the Halborn team.
Assessment Summary#
The team at Halborn was provided 3 days for the engagement and assigned a full-time security engineer to evaluate the security of the smart contract.
The security engineer is a blockchain and smart-contract security expert with advanced penetration testing, smart-contract hacking, and deep knowledge of multiple blockchain protocols.
The purpose of this assessment is to:
Ensure that smart contract functions operate as intended.
Identify potential security issues with the smart contracts.
In summary, Halborn identified some security risks that were addressed by the Prodigy team.
Scope#
Findings Overview#
# | Title | Severity | Score | Status |
|---|---|---|---|---|
HAL-01 | Price Manipulation Vulnerability in Vault Execution Due to Unchecked Pyth Oracle Updates | High | 8.6 | Solved10/28/2024 |
HAL-02 | Chainlink Oracle Price Feed Used Without Staleness Check | Medium | 6.3 | Solved10/28/2024 |
HAL-03 | Excess ETH Not Refunded in Price Update Transactions | Medium | 6.3 | Solved10/28/2024 |
HAL-04 | Zero Amount Transfer Vulnerability in Token Transfers | Medium | 6.3 | Solved10/28/2024 |
HAL-05 | Pyth oracle price is not validated properly | Medium | 4.7 | Solved10/28/2024 |
HAL-06 | Unrestricted Vault Creation in Factory Contract | Low | 3.1 | Solved10/28/2024 |
HAL-07 | Unsafe Casting Operations | Low | 3.1 | Solved10/28/2024 |
HAL-08 | Incorrect Fee Calculation Due to Delayed Initialization in Vault Contract | Low | 3.1 | Solved10/28/2024 |
HAL-09 | Incorrect State Modification Order in lpWithdraw Function | Low | 3.1 | Solved10/28/2024 |
HAL-10 | Missing Visibility Attribute | Informational | 0.0 | Solved10/28/2024 |
HAL-11 | Consider Using Named Mappings | Informational | 0.0 | Solved10/28/2024 |
Disclaimer#
Halborn strongly recommends conducting a follow-up assessment of the project either within six months or immediately following any material changes to the codebase, whichever comes first. This approach is crucial for maintaining the project’s integrity and addressing potential vulnerabilities introduced by code modifications.