Prepared by:
HALBORN
Last Updated 01/02/2025
Date of Engagement by: December 16th, 2024 - December 19th, 2024
Summary
100% of all REPORTED Findings have been addressed
All findings
8
Critical
0
High
2
Medium
2
Low
1
Informational
3
Table of Contents
1. Introduction
DCLM-Noon team engaged Halborn to conduct a security assessment on their smart contracts revisions started on December 16th, 2024 and ending on December 20th, 2024. The security assessment was scoped to the smart contracts provided to the Halborn team.
Commit hashes and further details can be found in the Scope section of this report.
2. Assessment Summary
The team at Halborn was provided 5 days for the engagement and assigned a security engineer to evaluate the security of the smart contract.
The security engineer is a blockchain and smart-contract security expert with advanced penetration testing, smart-contract hacking, and deep knowledge of multiple blockchain protocols.
The purpose of this assessment is to:
Ensure that smart contract functions operate as intended.
Identify potential security issues with the smart contracts.
n summary, Halborn identified some improvements to reduce the likelihood and impact of risks, which were mostly addressed by the DCLM-Noon team. The main ones were the following:
Implement mechanisms agains donation attack in the vault.Remove check which creates a DOS in redeem function.Re-implement the 2% difference between USN/Collateral when USN is minted.Implement a check to prevent rebasing role from breaking the vault.
3. SCOPE
- USN
- USNUpgradeable
- MinterHandler
4. Findings Overview
| Security analysis | Risk level | Remediation |
|---|---|---|
| Vault Donation Attack via Share Price Manipulation | High | Solved - 12/26/2024 |
| Redeem function DOS in vault | High | Solved - 12/26/2024 |
| Price Manipulation Through USN mint/redeem | Medium | Solved - 12/26/2024 |
| ERC4626 Share Price Calculation Through Direct Rewards Transfer to Empty Vault | Medium | Solved - 12/26/2024 |
| Lack of Decimal Validation Enables Arithmetic Overflow in Token Normalization | Low | Solved - 12/26/2024 |
| Centralization Risks Due to Privileged Roles | Informational | Acknowledged - 12/26/2024 |
| Operation Ordering Non-Optimal in Mint Function | Informational | Solved - 12/26/2024 |
| Lack of Collateral-Redemption Token Pair Enforcement Enables Protocol Arbitrage | Informational | Acknowledged - 12/26/2024 |
Halborn strongly recommends conducting a follow-up assessment of the project either within six months or immediately following any material changes to the codebase, whichever comes first. This approach is crucial for maintaining the project’s integrity and addressing potential vulnerabilities introduced by code modifications.
Table of Contents
// Download the full report
* Use Google Chrome for best results
** Check "Background Graphics" in the print settings if needed