Prepared by:
HALBORN
Last Updated 04/26/2024
Date of Engagement by: January 7th, 2022 - January 8th, 2022
Summary
100% of all REPORTED Findings have been addressed
All findings
1
Critical
0
High
0
Medium
0
Low
0
Informational
1
Table of Contents
1. INTRODUCTION
StaderLabs engaged Halborn to conduct a security audit on their smart contracts beginning on January 7th, 2022 and ending on January 8th, 2022. The security assessment was scoped to the smart contracts provided in the Github repository stader-labs/stader-token-erc20.
2. AUDIT SUMMARY
The team at Halborn was provided one week for the engagement and assigned a full time security engineer to audit the security of the smart contract. The security engineer is a blockchain and smart-contract security expert with advanced penetration testing, smart-contract hacking, and deep knowledge of multiple blockchain protocols.
The purpose of this audit is to:
Ensure that smart contract functions operate as intended
Identify potential security issues with the smart contracts
In summary, Halborn identified an informational finding that was addressed by StaderLabs team.
3. TEST APPROACH & METHODOLOGY
Halborn performed a combination of manual and automated security testing to balance efficiency, timeliness, practicality, and accuracy in regard to the scope of this audit. While manual testing is recommended to uncover flaws in logic, process,and implementation; automated testing techniques help enhance coverage of the bridge code and can quickly identify items that do not follow security best practices. The following phases and associated tools were used throughout the term of the audit:
Research into architecture and purpose
Smart contract manual code review and walkthrough
Graphing out functionality and contract logic/connectivity/functions (
solgraph)Manual assessment of use and safety for the critical Solidity variables and functions in scope to identify any arithmetic related vulnerability classes
Manual testing by custom scripts
Scanning of solidity files for vulnerabilities, security hotspots or bugs. (
MythX)Static Analysis of security for scoped contract, and imported functions. (
Slither)Testnet deployment (
Brownie,Remix IDE)
4. SCOPE
IN-SCOPE: The security assessment was scoped to the following smart contract:
Stader.sol
Commit ID: 9137e229ae01f05d472fee1881f1e8fe862f452c Fixed Commit ID: 904a150a5458af1d5d6ca043ed05521a2373f587
Stader Token Address: 0x30D20208d987713f46DFD34EF128Bb16C404D10f
5. RISK METHODOLOGY
- 5 - Almost certain an incident will occur.
- 4 - High probability of an incident occurring.
- 3 - Potential of a security incident in the long term.
- 2 - Low probability of an incident occurring.
- 1 - Very unlikely issue will cause an incident.
- 5 - May cause devastating and unrecoverable impact or loss.
- 4 - May cause a significant level of impact or loss.
- 3 - May cause a partial impact or loss to many.
- 2 - May cause temporary impact or loss.
- 1 - May cause minimal or un-noticeable impact.
- 10 - CRITICAL
- 9 - 8 - HIGH
- 7 - 6 - MEDIUM
- 5 - 4 - LOW
- 3 - 1 - VERY LOW AND INFORMATIONAL
6. SCOPE
7. Assessment Summary & Findings Overview
Critical
0
High
0
Medium
0
Low
0
Informational
1
Impact x Likelihood
HAL-01
| Security analysis | Risk level | Remediation Date |
|---|---|---|
| SOLC 0.8.2 COMPILER VERSION CONTAINS MULTIPLE BUGS | Informational | Solved - 01/17/2022 |
8. Findings & Tech Details
8.1 SOLC 0.8.2 COMPILER VERSION CONTAINS MULTIPLE BUGS
// Informational
Description
Solidity compiler version 0.8.3, 0.8.4 and 0.8.9 fixed important bugs in the compiler. The version 0.8.2 set in the hardhat.config.js file is missing all these fixes:
Score
Likelihood: 1
Recommendation
SOLVED: The StaderLabs team set the pragma to the 0.8.9 version.
9. Review Notes
Halborn performed several manual tests in the Stader.sol contract:
As the contract just follows the standard OpenZeppelin ERC20 contracts ERC20, ERC20Burnable, ERC20Permit and ERC20Votes, the manual tests were focused on testing the main functions of these contracts:
approve()balanceOf()burn()burnFrom()decreaseAllowance()delegate()increaseAllowance()transfer()transferFrom()
The delegateBySig() function was also tested:
And also the permit() function:
No issues were found during the manual tests.
10. Automated Testing
STATIC ANALYSIS REPORT
Description
Halborn used automated testing techniques to enhance the coverage of certain areas of the scoped contracts. Among the tools used was Slither, a Solidity static analysis framework. After Halborn verified all the contracts in the repository and was able to compile them correctly into their ABI and binary formats, Slither was run on the all-scoped contracts. This tool can statically verify mathematical relationships between Solidity variables to detect invalid or inconsistent usage of the contracts' APIs across the entire code-base.
Slither results
Stader.sol
No major issues were found by Slither.
ERC20 checks
Stader.sol
All the Slither ERC20 checks were passed successfully.
AUTOMATED SECURITY SCAN
Description
Halborn used automated security scanners to assist with detection of well-known security issues, and to identify low-hanging fruits on the targets for this engagement. Among the tools used was MythX, a security analysis service for Ethereum smart contracts. MythX performed a scan on all the contracts and sent the compiled results to the analyzers to locate any vulnerabilities.
MythX results
Stader.sol
No major issues were found by MythX
Halborn strongly recommends conducting a follow-up assessment of the project either within six months or immediately following any material changes to the codebase, whichever comes first. This approach is crucial for maintaining the project’s integrity and addressing potential vulnerabilities introduced by code modifications.
Table of Contents
// Download the full report
* Use Google Chrome for best results
** Check "Background Graphics" in the print settings if needed