Prepared by:
HALBORN
Last Updated 04/26/2024
Date of Engagement by: February 14th, 2022 - February 18th, 2022
0% of all REPORTED Findings have been addressed
All findings
1
Critical
0
High
1
Medium
0
Low
0
Informational
0
Mars Protocol engaged Halborn to conduct a security assessment on CosmWasm smart contracts beginning on February 14th, 2022 and ending February 18th, 2022.
The security engineers involved on the audit are blockchain and smart-contract security experts with advanced penetration testing, smart-contract hacking, and deep knowledge of multiple blockchain protocols.
The purpose of this audit is to achieve the following:
Ensure that smart contract functions work as intended.
Identify potential security issues with the smart contracts.
In summary, Halborn identified some improvements to reduce the likelihood and impacts of the risks, which were accepted by Mars team. The main ones are the following:
Update the logic of some functions in mars-red-bank contract to turn addresses into lower case.
Update and store the amount of Mars tokens owned by mars-staking contract in its storage when staking / unstaking.
External threats, such as financial related attacks, oracle attacks, and inter-contract functions and calls should be validated for expected logic and state.
Halborn performed a combination of manual review of the code and automated security testing to balance efficiency, timeliness, practicality, and accuracy in regard to the scope of the smart contract audit. While manual testing is recommended to uncover flaws in logic, process, and implementation; automated testing techniques help enhance coverage of smart contracts and can quickly identify items that do not follow security best practices. The following phases and associated tools were used throughout the term of the audit:
Research into architecture, purpose, and use of the platform.
Manual code read and walkthrough.
Manual assessment of use and safety for the critical Rust variables and functions in scope to identify any contracts logic related vulnerability.
Fuzz testing (Halborn custom fuzzing tool)
Checking the test coverage (cargo tarpaulin)
Scanning of Rust files for vulnerabilities (cargo audit) \newline
\begin{enumerate} \item CosmWasm Smart Contracts \begin{enumerate} \item Repository: \href{https://github.com/mars-protocol/mars-core}{mars-core} \item Commit ID: \href{https://github.com/mars-protocol/mars-core/tree/d08152d5fc0294635c57b8bc51fe0962c79e4363 }{d08152d5fc0294635c57b8bc51fe0962c79e4363} \item Contracts in scope: \begin{enumerate} \item mars-council \item mars-red-bank \item mars-vesting \end{enumerate} \end{enumerate} \end{enumerate}
It is worth noting that the results of this audit are a complement to the information provided in a previous report for the security audit performed to the codebase with commit id fcaa6ffe918a0890a1a6c57f26edb6f8feb25633.
Out-of-scope: External libraries and financial related attacks
Critical
0
High
1
Medium
0
Low
0
Informational
0
Impact x Likelihood
HAL-01
| Security analysis | Risk level | Remediation Date |
|---|---|---|
| MULTIPLE CONSEQUENCES WHEN INTERACTING WITH UPPER-CASE ADDRESSES | High | Future Release |
// High
When users deposit, withdraw, borrow or repay in contracts/mars-red-bank/src/contract.rs using on_behalf_of / recipient_address address in upper case (e.g.: TERRA1KG...XNL8), the following consequences occur:
These issues happen because the values are stored in contract's storage with the upper case address as a key, which creates conflicts when values are loaded using info.sender as a key, which is always in lower case (e.g.: terra1kg...xnl8).
mars-red-bank: execute_deposit (on_behalf_of)
mars-red-bank: execute_withdraw (recipient_address)
mars-red-bank: execute_borrow (recipient_address)
mars-red-bank: execute_repay (on_behalf_of)
PENDING: The Mars team stated that in the short term they would analyze how to address this issue comprehensively on the protocol.
Halborn strongly recommends conducting a follow-up assessment of the project either within six months or immediately following any material changes to the codebase, whichever comes first. This approach is crucial for maintaining the project’s integrity and addressing potential vulnerabilities introduced by code modifications.
// Download the full report
* Use Google Chrome for best results
** Check "Background Graphics" in the print settings if needed