Keys Contracts & Token - AgentCoin TV

The AgentKey.sol contract is compiled using Solidity version 0.5.17:

// SPDX-License-Identifier: UNLICENSED
pragma solidity 0.5.17;

This version contains multiple known vulnerabilities including:

1. AbiReencodingHeadOverflowWithStaticArrayCleanup (SOL-2022-6): When ABI-encoding tuples with statically-sized calldata arrays, it corrupts 32 leading bytes of dynamically encoded components.

2. NestedCalldataArrayAbiReencodingSizeValidation (SOL-2022-2): ABI-reencoding of nested dynamic calldata arrays does not perform proper size checks against calldata size and reads beyond calldatasize().

3. ABIDecodeTwoDimensionalArrayMemory (SOL-2021-2): The ABI decoder does not properly validate pointers for dynamically-sized data when decoding from memory, leading to incorrect results.

4. DynamicArrayCleanup (SOL-2020-10): Storage slots are not properly zeroed out when assigning dynamically-sized arrays with types <= 16 bytes.

Reference

The vulnerabilities in Solidity 0.5.17 affect core language features like ABI encoding/decoding and array handling. This exposes the contract to memory corruption, invalid data reading, and improper storage cleanup - compromising the reliability and security of core contract functionality.

Upgrade to at least Solidity version 0.8.19 which has fixed these vulnerabilities and includes additional safety features like:

• Built-in overflow checks

• More restrictive type casting

• Improved error handling

• Explicit mutability requirements

RISK ACCEPTED: Due to the fact that not major risk from 0.5.17 are present in the code, AgentCoin team decided to not upgrade to a newer solidity version.

The AgentKey contract and its dependencies use different Solidity compiler versions which breaks version consistency across the protocol. The core contract uses Solidity 0.5.17 while its whitelist interface uses 0.8.13:

solidity
Copy
// AgentKey.sol
pragma solidity 0.5.17;

import {DecentralizedAutonomousTrust} from "@fairmint/contracts/DecentralizedAutonomousTrust.sol";
import "@openzeppelin/contracts-ethereum-package/contracts/utils/Address.sol";

// AgentKeyWhitelist.sol
pragma solidity ^0.8.13;

contract AgentKeyWhitelist {
    function authorizeTransfer(address _from, address _to, uint256, bool) external pure {
        require(_from == address(0) || _to == address(0), "TRANSFERS_DISABLED");
    }
}

Impact :

1. Inconsistencies in type handling between compiler versions

2. Breaking changes in internal compiler behaviors between 0.5.x and 0.8.x

3. Different security checks and optimizations applied across contract components

Standardize all contracts to use the same Solidity version.

RISK ACCEPTED: Due to the fact that not major risk from 0.5.17 are present in the code, AgentCoin team decided to not upgrade to a newer solidity version.

The AgentKey contract uses a constructor for initialization while inheriting from an initializable contract (DecentralizedAutonomousTrust). This creates inconsistency in the initialization pattern when used with proxy contracts.

// AgentKey.sol
contract AgentKey is DecentralizedAutonomousTrust {
    constructor(
        uint256 _initReserve,
        address _currencyAddress,
        uint256 _initGoal,
        uint256 _buySlopeNum,
        uint256 _buySlopeDen,
        uint256 _investmentReserveBasisPoints,
        uint256 _setupFee,
        address payable _setupFeeRecipient,
        string memory _name,
        string memory _symbol
    ) public {
        initialize(
            _initReserve,
            _currencyAddress,
            _initGoal,
            _buySlopeNum,
            _buySlopeDen,
            _investmentReserveBasisPoints,
            _setupFee,
            _setupFeeRecipient,
            _name,
            _symbol
        );
    }
}

// DecentralizedAutonomousTrust.sol
function initialize(
    uint _initReserve,
    address _currencyAddress,
    ...
) public {
// Initialize logic
}

Impact :

1. Incorrect initialization sequence when deployed behind a proxy

2. Constructor code not included in the deployed proxy implementation

3. Broken initialization pattern inheritance chain

Convert the constructor to an initializer function:

contract AgentKey is DecentralizedAutonomousTrust {
/// @custom:oz-upgrades-unsafe-allow constructor
    constructor() initializer {}

    function initialize(
        uint256 _initReserve,
        address _currencyAddress,
        uint256 _initGoal,
        uint256 _buySlopeNum,
        uint256 _buySlopeDen,
        uint256 _investmentReserveBasisPoints,
        uint256 _setupFee,
        address payable _setupFeeRecipient,
        string memory _name,
        string memory _symbol
    ) public initializer {
        super.initialize(
            _initReserve,
            _currencyAddress,
            _initGoal,
            _buySlopeNum,
            _buySlopeDen,
            _investmentReserveBasisPoints,
            _setupFee,
            _setupFeeRecipient,
            _name,
            _symbol
        );
    }
}

RISK ACCEPTED: No upgradability will be used because AgentCoin team decided not to change the current code.