Penetration Test Report (SecuRing): TellorX   20211013

www.securing.biz
S C S R
MART ONTRACTS ECURITY EVIEW
T I .
FOR ELLOR NC
R
EPORT
document version: 1.0
author: Damian Rusinek (SecuRing)
test time period: 2021-09-07 – 2021-10-11
report date: 2021-10-13
Smart Contracts Security Review
TABLE OF CONTENTS
1. Executive summary ..................................................................................................................................... 3
1.1. Summary of test results .................................................................................................................... 3
1.2. Compliance with Smart Contract Security Verification Standard ............................................ 3
2. Project overview .......................................................................................................................................... 5
2.1. Project description ............................................................................................................................ 5
2.2. Target in scope ................................................................................................................................... 5
2.3. Threat analysis .................................................................................................................................... 6
2.4. Testing overview ................................................................................................................................ 7
2.5. Basic information ............................................................................................................................... 8
2.6. Disclaimer ............................................................................................................................................ 8
3. Summary of identified vulnerabilities ...................................................................................................... 9
3.1. Risk classification ............................................................................................................................... 9
3.2. Identified vulnerabilities ................................................................................................................ 10
4. Vulnerabilities ............................................................................................................................................ 11
4.1. No-voting penalty bypass ............................................................................................................. 11
4.2. Non-withdrawable treasury.......................................................................................................... 12
4.3. Non-compliant fees calculation ................................................................................................... 13
4.4. Outdated data in events ................................................................................................................ 14
4.5. Lack of proper requirements for init function ........................................................................... 15
4.6. Not implemented functions .......................................................................................................... 16
4.7. Unintended revert .......................................................................................................................... 17
4.8. Lack of new owner and deity validation .................................................................................... 18
4.9. Invalid Main Tellor address hard-coded ..................................................................................... 19
5. Recommendations .................................................................................................................................... 21
5.1. Consider additional safeguards against the known approve function problem ................. 21
5.2. Improve code clarity ....................................................................................................................... 22
5.3. Consider optimizing indicated functions .................................................................................... 30
5.4. Fix calculations for small numbers .............................................................................................. 31
5.5. Consider using constants for status values ............................................................................... 32
5.6. Consider following Check-Effects-Interactions ....................................................................... 33
5.7. Set variables visibility explicitly.................................................................................................... 33
- 1 -
Smart Contracts Security Review
5.8. Validate parameters and set clear limits .................................................................................... 34
5.9. Inherit from interfaces for consistency ...................................................................................... 35
5.10. Consider protecting killContract function ................................................................................. 35
6. SCSVS ......................................................................................................................................................... 37
6.1. Failed checks.................................................................................................................................... 37
7. Terminology ............................................................................................................................................... 39
8. Contact ....................................................................................................................................................... 40
- 2 -
Smart Contracts Security Review
1. EXECUTIVE SUMMARY
1.1. Summary of test results
• There are neither vulnerabilities with critical nor with high impact on risk found.
• There are 5 vulnerabilities with medium impact on risk found. Their potential
consequences are:
o Bypassing no-voting penalty and receiving the whole treasury reward (4.1).
o Lagging voting system (4.1).
o Lock of the funds used to buy treasury (4.2).
o Paying different fee that specified in whitepaper (4.3).
o Invalid business logic flow in the external application (4.4).
o Initializing contract more than once with new parameters (4.5).
• There are 4 vulnerabilities with low impact on risk found. Their potential
consequences are:
o Denial of Service of the integrating contracts (4.6).
o Temporal denial of service (4.7).
o Losing control over the owner address and no possibility to initialize new
version (4.8).
o Use of an incorrect implementation (4.9).
• Additionally, 10 recommendations have been proposed that do not have any direct
risk impact. However, it is suggested to implement them due to good security
practices.
• The upgrade process has been reviewed and no critical issues has been found.
1.2. Compliance with Smart Contract Security Verification Standard
Smart Contracts: TellorX smart contracts
Damian Rusinek,
Security Auditors:
Pawel Kurylowicz
Verification date: 08.10.2021r.
Passed: 83
Failed: 29
Not applicable: 18
Total score: 74% 83/112
The categories in which some of the requirements has not been met are:
• V1: Architecture, Design and Threat Modelling
• V2: Access Control
• V3: Blockchain Data
- 3 -
Smart Contracts Security Review
• V4: Communications
• V5: Arithmetic
• V6: Malicious Input Handling
• V8: Business Logic
• V9: Denial of Service
• V10: Token
• V11: Code Clarity
• V12: Test Coverage
• V13: Known Attacks
• V14: Decentralized Finance
None of the failed checks currently have a critical impact on the security of the system.
The results of SCSVS compliance verification are attached to the report in the
SCSVS_v_12_Tellor.xlsx file.
- 4 -
Smart Contracts Security Review
2. PROJECT OVERVIEW
2.1. Project description
The analyzed system is a new version of oracle system. It continue