Borderless Money - Audit Report

Table Of Content



BlockApex (Auditor) was contracted by  Borderless Money (Client) for the purpose of conducting a Smart Contract Audit/Code Review. This document presents the findings of our analysis which started on  Septemebr 12th, 2022. 

Borderless Money
Audited by
Ethereum | Solidity
Type of review
Manual Code Review | Automated Tools Analysis
Architecture Review | Functional Testing | Computer-Aided Verification
Git repository/ Commit Hash
Website URL
Document log
Audit Completed: September 16th, 2022


The git-repository shared was checked for common code violations along with vulnerability-specific probing to detect major issues/vulnerabilities. Some specific checks are as follows:

Code reviewCode review Functional review
ReentrancyUnchecked external callBusiness Logics Review
Ownership Takeover ERC20 API violationFunctionality Checks
Timestamp DependenceUnchecked mathAccess Control & Authorization
Gas Limit and LoopsUnsafe type inferenceEscrow manipulation
DoS with (Unexpected)
Implicit visibility levelToken Supply manipulation
DoS with Block Gas LimitDeployment ConsistencyAsset’s integrity
Repository ConsistencyUser Balances manipulation
Style guide violationData ConsistencyKill-Switch Mechanism
Costly LoopOperation Trails & Event

Project Overview

Borderless Money is a decentralized finance protocol redefining how Social Investments are made, using yield-generating strategies and contributing to social causes. An open, borderless digital society, with borderless money, where the goods, services, technology, information, opportunities, and capital can flow through the borders from one hand to many, fairly, transparently. 

Methodology & Scope

The BOM Token codebase was audited using a filtered audit technique. A pair of auditors scanned the codebase in an iterative process spanning over a span of 4 days. 

Starting with the recon phase, a basic understanding was developed and the auditors worked on establishing presumptions for the codebase and the relevant documentation/ whitepaper provided or found publicly. 

Furthermore, the audit moved on with the manual code reviews with the motive to find logical flaws in the codebase complemented with code optimizations, software and security design patterns, code styles, best practices and identifying false positives that were detected by automated analysis tools.

Audit Report

Executive Summary

The analysis indicates that the contract under scope of audit is working properly.

Our team performed a technique called “Filtered Audit”, where the contract was separately audited by two individuals. After a thorough and rigorous process of manual testing, an automated review was carried out using tools like slither for an extensive static analysis and foundry for property testing the invariants of the system. All the flags raised were manually reviewed in collaboration and re-tested to identify the false positives.

Borderless money - meter

Our Team Found

# of issuesSeverity Of the Risk
0Critical Risk Issues(s)
0High Risk Issues(s)
0Medium Risk Issues(s)
0Low Risk Issues(s)
0Informatory Risk Issues(s)

Properties Tested

#PropertiesType Status
1.Compliant with ERC20 standardCustomPassed
2. Should mint initial supply to msg.sender on deploymentCustomPassed
3.Should be able to approve tokensCustomPassed
4.Should be able to increase allowanceCustomPassed
5.Should be able to decrease allowanceCustomPassed
6.Should be able to spend approved tokensCustomPassed
7.Should not be able to mint more than initial supplyCustomPassed
8.Should update balances of sender and recipient when token transferredCustomPassed
9.Reverts if sender doesn’t holds enough token balance for sendingCustomPassed
10.Reverts if spender doesn’t hold enough approval to spend someone’s tokensCustomPassed
11.Functions and state variables visibility should be set explicitly. Visibility levels should be specified consciously.SWC-100SWC-108 Passed
12.Contracts should be deployed with the same compiler version and flags that they have been tested thoroughly.SWC-101Passed
13.It is recommended to use a recent version of the Solidity compiler.SWC-102Passed
14.Contracts should be deployed with the same compiler version and flags that they have been tested thoroughly.SWC-103Passed
15.Ownership takeover should not be possible. All crucial functions should be protected. Users could not affect data that belongs to other users.CWE-284Passed
16.Race Conditions and Transactions Order Dependency should not be possible.CWE-114Passed
17.Tokens can be minted only according to rules specified in a whitepaper or any other documentation provided by the customer.CustomPassed
18.Incorrect Inheritance Order which may result in unusual behaviour of smart contract functionsSWC-125Passed


The smart contracts provided by the client for audit purposes have been thoroughly analyzed in compliance with the global best practices till date w.r.t cybersecurity vulnerabilities and issues in smart contract code, the details of which are enclosed in this report. 

This report is not an endorsement or indictment of the project or team, and they do not in any way guarantee the security of the particular object in context. This report is not considered, and should not be interpreted as an influence, on the potential economics of the token, its sale or any other aspect of the project. 

Crypto assets/tokens are results of the emerging blockchain technology in the domain of decentralized finance and they carry with them high levels of technical risk and uncertainty. No report provides any warranty or representation to any third-Party in any respect, including regarding the bug-free nature of code, the business model or proprietors of any such business model, and the legal compliance of any such business.

No third-party should rely on the reports in any way, including for the purpose of making any decisions to buy or sell any token, product, service or other asset. Specifically, for the avoidance of doubt, this report does not constitute investment advice, is not intended to be relied upon as investment advice, is not an endorsement of this project or team, and it is not a guarantee as to the absolute security of the project.

Smart contracts are deployed and executed on a blockchain. The platform, its programming language, and other software related to the smart contract can have its vulnerabilities that can lead to hacks. The scope of our review is limited to a review of the Solidity code and only the Solidity code we note as being within the scope of our review within this report. The Solidity language itself remains under development and is subject to unknown risks and flaws. The review does not extend to the compiler layer, or any other areas beyond Solidity that could present security risks.

This audit cannot be considered as a sufficient assessment regarding the utility and safety of the code, bug-free status or any other statements of the contract. While we have done our best in conducting the analysis and producing this report, it is important to note that you should not rely on this report only - we recommend proceeding with several independent audits and a public bug bounty program to ensure security of smart contracts.

More Audits

Polkalokr Matic Bridge Contract Audit Report

The analysis indicates that the contracts audited are secured and follow the best practices.
Our team performed a technique called “Filtered Audit”, where the contract was separately audited by two individuals. After their thorough and rigorous process of manual testing, an automated review was carried out using Slither, and Manticore. All the flags raised were manually reviewed and re-tested.

Flower Fam NFT Audit Report

Flower Fam is an NFT-based project, after you mint your NFT you can “harvest” them on weekly bases to get 60% royalties. It's quite simple: every flower has a 10% chance to win. The rarer the species of a flower.

Dafi BSC-ETH Bridge (Final Audit)

Dafi’s “dbridge” enables users to bring their ERC-20 $DAFI tokens across from the Ethereum network to Binance Smart Chain, and vice versa, with aims of making $DAFI available on multiple high-speed and low-cost networks.

Sonar Bridge Initial Audit

BlockApex (Auditor) was contracted by Sonar(Client) for the purpose of conducting a Smart Contract Audit/Code Review of Sonar bridge modeule.  This document presents the findings of our analysis which took place on 8th September 2021. 

Script TV - Audit Report

Script TV is a decentralized video delivery network that furnishes an expansive range of blockchain-enabled solutions to the problems related to the traditional video-streaming sector.

Smart Contract Audit Report: Chrysus

Project Chrysus aims to be a fully decentralized ecosystem revolving around Chrysus Coin. Chrysus Coin (Chrysus) is an ERC20 token deployed on the Ethereum network, which is pegged to the price of gold (XAU/USD) using Decentralized Finance (DeFi) best practices. The ecosystem around Chrysus will involve a SWAP solution, a lending solution, and an eCommerce integration solution allowing for the use of Chrysus outside of the DeFi ecosystem.

Spin Finance Audit Report

Spin Finance is a DeFi derivative infrastructure built on NEAR Protocol, a reliable and scalable L1 solution. The on-chain order book solution offered by Spin provides a CEX-competitive experience to DeFi users.

KaliDAO Audit Report

BlockApex (Auditor) was contracted by KaliCo LLC_ (Client) for the purpose of conducting a Smart Contract Audit/Code Review of KaliDAO. This document presents the findings of our analysis which took place from 20th of December 2021

Phase Protocol Audit Report

Phase Protocol is a NFT Marketplace infrastructure built on Solana Protocol, a reliable and scalable L1 solution. The on-chain Fundraising solution offered by DedMonke provides a crowdfunding experience to DeFi users.

1 2 3
Designed & Developed by: 
All rights reserved. Copyright 2023