Sonar Bridge V2 Initial Audit

Table Of Content

Share:

INTRODUCTION

BlockApex (Auditor) was contracted by    SONAR    (Client) for the purpose of conducting a Smart Contract Audit/Code Review. This document presents the findings of our analysis which took place on   28th September 2021  . 

Name: Sonar BSC-ETH bridge v2
Auditor: Moazzam Arif | Kaif Ahmed
Platform: Ethereum/Solidity
Type of review: Bridge
Methods: Architecture Review, Functional Testing, Computer-Aided Verification, Manual Review
Git repository: https://github.com/XORD-one/sonar-bridge-contract/tree/17cb255444153945b66c5da8672f2ca06ec91efd
White paper/ Documentation: Not provided
Document log: Bridge v1 Audit (08-09-2021) | Bridge v2 Audit (28-09-2021)*

Scope

The git-repository shared was checked for common code violations along with vulnerability-specific probing to detect major issues/vulnerabilities. Some specific checks are as follows:

Code reviewFunctional review
Reentrancy Unchecked external callBusiness Logics Review
Ownership TakeoverERC20 API violationFunctionality Checks
Timestamp DependenceUnchecked mathAccess Control & Authorization
Gas Limit and LoopsUnsafe type inferenceEscrow manipulation
DoS with (Unexpected) ThrowImplicit visibility levelToken Supply manipulation
DoS with Block Gas LimitDeployment ConsistencyAsset’s integrity
Transaction-Ordering DependenceRepository ConsistencyUser Balances manipulation
Style guide violationData ConsistencyKill-Switch Mechanism
Costly LoopOperation Trails & Event Generation

Project Overview

This is a POA bridge application that provides ETH to BSC and BSC to ETH bridging. It allows its native tokens to be accessed on both ETH and BSC blockchains.

System Architecture

Steps to burn and mint (BSC => ETH):

1. User calls the burn method on BSC bridge (BSC blockchain)

2. With the burn method, tokens are transferred to the admin account 

3. Transfer event is emitted on successful burn

4. Relayer listens the event and call the mint method on ETH bridge 

5. With the mint method, the tokens are transferred to the user on the ethereum blockchain

For ETH => BSC similar steps are followed. 

Methodology & Scope

Smart contract for the native token (PING) was provided. As $PING is similar to $RFI and $SAFEMOON. So the swapping and fee distributions were primarily focused during this security assessment (as they had already been audited by Certik). Only minting and burning functionality of $ePING (ethereum representation of $PING) was considered in scope. Manual Review and Static Analysis tools were used to produce this report.

AUDIT REPORT

Executive Summary

The analysis indicates that some of the functionalities in the contracts audited are not working properly.


Our team performed a technique called “Filtered Audit”, where the contract was separately audited by two individuals. After their thorough and rigorous process of manual testing, an automated review was carried out using Mythril, MythX and Slither. All the flags raised were manually reviewed and re-tested. 

Our team found: 

# of issues Severity of the risk
0Critical Risk issue(s)
1High Risk issue(s)
0Medium Risk issue(s)
1Low Risk issue(s)
5Informatory issue(s)

Findings

Critical-risk issues

No issues were found

High-risk issues

1. No Minting and Burning in ePING
File:  ePING.sol
_tTotal represents the totalSupply. Initially on the second chain _tTotal is set to 0 in the constructor. _tTotal is used to calculate the currentRate and currentRate is used while transferring and burning. Setting _tTotal to zero gives math errors. While minting _rTotal is so high (~uint(0 => ~MAX value of uint256)). Adding any value to _rTotal will cause underflow.
NOTE: Please carefully set the _rTotal. Also while minting do not change the currentRate, as it will be reflected in other users’ balances

Medium-risk issues

No issues were found.

Low-risk issues

1. GasFee Griefing Attack
Assuming that the relayer server (owned by the client) pays the gasFee to mint/unlock tokens on the alternate bridge. As there is no min_amount limit on bridging tokens. Consider the following Attack Scenario
Attack Scenario:
1. User deposits 0/1 wei amount of token on BscBridge.
2. Relayer server picks-up the deposit event and calls the mint function on etheremBridge.
3. User receives 0/1 wei tokens. And Relayer pays the gas.
4. As gas fees are high, we can deduce that 1 wei tokens < gasFee (paid by relayer).
Remedy:
1. Charge gas fee from the user. While bridging the tokens, mint amount - gasFeeEquivalent on alternate chain.
2. Put a minimum threshold on the amount of tokens to be bridged.

Informatory issues and Optimization

1. transactionID is used while depositing into the bridges. transactionID is not verified in the smart contracts. It is used when the deposit event is emitted. We advise you to validate transactionID at the backend (relayer servers).

2. Destination chainId should be used while depositing. This will improve user experience if multiple chains are supported for bridging in future.

3. Remove console.log from smart contract.

4. IToken.sol has a wrong implementation of interface. Use Openzeppelin’s ERC20 interface.

5. Fees are deducted on every transfer. Please make sure that the bridge addresses are excluded from the fees.

DISCLAIMER

The smart contracts provided by the client for audit purposes have been thoroughly analyzed in compliance with the global best practices till date w.r.t cybersecurity vulnerabilities and issues in smart contract code, the details of which are enclosed in this report. 

This report is not an endorsement or indictment of the project or team, and they do not in any way guarantee the security of the particular object in context. This report is not considered, and should not be interpreted as an influence, on the potential economics of the token, its sale or any other aspect of the project. 

Crypto assets/tokens are results of the emerging blockchain technology in the domain of decentralized finance and they carry with them high levels of technical risk and uncertainty. No report provides any warranty or representation to any third-Party in any respect, including regarding the bug-free nature of code, the business model or proprietors of any such business model, and the legal compliance of any such business. No third-party should rely on the reports in any way, including for the purpose of making any decisions to buy or sell any token, product, service or other asset. Specifically, for the avoidance of doubt, this report does not constitute investment advice, is not intended to be relied upon as investment advice, is not an endorsement of this project or team, and it is not a guarantee as to the absolute security of the project.

Smart contracts are deployed and executed on a blockchain. The platform, its programming language, and other software related to the smart contract can have its vulnerabilities that can lead to hacks. The scope of our review is limited to a review of the Solidity code and only the Solidity code we note as being within the scope of our review within this report. The Solidity language itself remains under development and is subject to unknown risks and flaws. The review does not extend to the compiler layer, or any other areas beyond Solidity that could present security risks.

This audit cannot be considered as a sufficient assessment regarding the utility and safety of the code, bug-free status or any other statements of the contract. While we have done our best in conducting the analysis and producing this report, it is important to note that you should not rely on this report only - we recommend proceeding with several independent audits and a public bug bounty program to ensure security of smart contracts.


More Audits

Polkalokr Matic Bridge Contract Audit Report

The analysis indicates that the contracts audited are secured and follow the best practices.
Our team performed a technique called “Filtered Audit”, where the contract was separately audited by two individuals. After their thorough and rigorous process of manual testing, an automated review was carried out using Slither, and Manticore. All the flags raised were manually reviewed and re-tested.

Dafi BSC-ETH Bridge (Final Audit)

Dafi’s “dbridge” enables users to bring their ERC-20 $DAFI tokens across from the Ethereum network to Binance Smart Chain, and vice versa, with aims of making $DAFI available on multiple high-speed and low-cost networks.

Unipilot Final Audit Report

In our first iteration, we found 1 critical-risk issue, 4 high-risk issues, 1 medium-risk, 1 low-risk issue and 1 informatory issue. All these issues were refactored and fixes have been made. A detailed report on the first review can be found here.

Stay in Touch

Drop your email to read the BlockApex newsletter and keep yourself updated around the clock.

    All rights reserved. Copyright 2020-21