Penetration Test Report (TrailOfBits): OriginDollar

Origin Dollar
Security Assessment
January 5 , 2 021
Prepared For:
Josh Fraser | O rigin Protocol
josh@originprotocol.com
Prepared By:
Alexander Remie | T rail of Bits
alexander.remie@trailofbits.com
Dominik Teiml | T rail of Bits
dominik.teiml@trailofbits.com
Changelog:
November 18, 2020: Draft final report delivered
December 18, 2020: Added Appendix E with retest results
December 21, 2020: Updated Appendix E to reflect newest changes
January 5, 2021: Updated Appendix E to reflect newest changes
/
Executive Summary
Project Dashboard
Code Maturity Evaluation
Engagement Goals
Coverage
Automated Testing and Verification
Recommendations Summary
Short term
Long term
Findings Summary
1. Invalid vaultBuffer could revert allocate
2. OUSD.changeSupply should require rebasingCreditsPerToken > 0
3. SafeMath is recommended in OUSD._executeTransfer
4. Transfers could silently fail without safeTransfer
5. Proxies are only partially EIP-1967-compliant
6. Queued transactions cannot be canceled
7. Unused code could cause problems in future
8. Proposal transactions can be executed separately and block Proposal.execute call
9. Proposals could allow Timelock.admin takeover
10. Reentrancy and untrusted contract call in mintMultiple
11. Off-by-one minDrift/maxDrift causes unexpected revert
12. Unsafe last array element removal poses future risk
13. Strategy targetWeight can be set for non-existent strategy
14. Lack of minimum redeem value might lead to less return than expected
15. withdraw allows redeemer to withdraw accidentally sent tokens
16. Variable shadowing from OUSD to ERC20
17. VaultCore.rebase functions have no return statements
18. Multiple contracts are missing inheritances
19. Lack of return value checks can lead to unexpected results
20. External calls in loop can lead to denial of service
21. No events for critical operations
22. OUSD allows users to transfer more tokens than expected
23. OUSD total supply can be arbitrary, even smaller than user balances
A. Vulnerability Classifications
© 2020 Trail of Bits Origin Dollar Assessment | 1
/
B. Code Maturity Classifications
C. Code Quality Recommendations
D. Token Integration Checklist
General Security Considerations
ERC Conformity
Contract Composition
Owner privileges
Token Scarcity
E. Fix Log
Detailed fix log
© 2020 Trail of Bits Origin Dollar Assessment | 2
/
Executive Summary
From November 2 through November 17, 2020, Origin Protocol engaged Trail of Bits to
review the security of Origin Dollar. Trail of Bits conducted this assessment over the course
of 4 person-weeks with 2 engineers working from 8 1431fd.
The first week, we gained an overall understanding of the codebase. We reviewed the
OUSD contract and started reviewing the Vault contracts. Our focus was on the rebasing
process and invariants of OUSD, the allocation of funds inside VaultCore, and the
VaultAdmin contract. In week two, we focused on the AaveStrategy and CompoundStrategy
contracts, and the various Oracle and Governance-related contracts. In the two days of the
final week, we dedicated further review to the VaultCore contract.
Our review resulted in 23 findings ranging from high to informational severity. One of the
high-severity issues is of low difficulty and would allow an attacker to drain the funds of the
system. Several other high-severity issues were of higher difficulty and originated in the
governance-related contracts and OUSD contract. The high-severity issues we found are:
● Missing input validation when depositing stablecoins for OUSD, allowing an attacker
to drain the funds of the contract. (T OB-OUSD-010) .
● Incorrect access controls prohibiting Governance Proposals from being canceled
(T OB-OUSD-006) .
● Missing check that could block the retrieval of OUSD account balances
(T OB-OUSD-002) .
● Lack of access controls allowing Governance Proposal transactions to be executed
separately instead of atomically (T OB-OUSD-008) .
● Lack of input validation could allow Governance admin role takeover
(T OB-OUSD-009) .
● External calls in a loop could lead to DoS (T OB-OUSD-020) .
● Not checking the return value could lead to a user not getting back collateral when
redeeming their OUSD (T OB-OUSD-019) .
● OUSD allows transferring more tokens than a user has due to rounding issues
(T OB-OUSD-022) .
● OUSD violates a common ERC20 invariant (T OB-OUSD-023) .
We also found several issues related to input validation (T OB-OUSD-010, T OB-OUSD-001,
TOB-OUSD-013) . There were also several best practices that were not adhered to: not using
SafeMath (T OB-OUSD-003) , unsafe last array element deletion (T OB-OUSD-012) , not
checking ERC20 transfer return value (T OB-OUSD-004) , missing events for important
operations (T OB-OUSD-021) , variable shadowing (T OB-OUSD-016) , and missing return
statements (T OB-OUSD-017) . Additional code quality points can be found in A ppendix C.
© 2020 Trail of Bits Origin Dollar Assessment | 3
/
Overall, the Origin Dollar contracts are not yet ready for deployment. The high severity
issue that allowed contract funds to be drained, caused by missing input validation and not
taking reentrancy into account, exemplifies the current state of the project. Missing input
validation in dozens of functions and issues in Governance contracts further indicates that
more work is required before deployment. Finally, several issues were detected using
automated analysis with S lither and c rytic.io, including a high severity vulnerability,
highlighting the processes for testing and verification that need improvement.
Trail of Bits recommends addressing the short- and long-term findings presented in this
report. We also recommend a feature freeze until the existing features are properly
documented and their assumptions tested in-depth. Finally, due to the prevalence of
high-severity findings, we recommend additional focused security reviews once the
reported findings have been addressed.
Update December 21, 2020: Trail of Bits reviewed fixes provided by Origin Protocol for the issues
described in this report. Further information can be found in A ppendix F. Fix Log.
© 2020 Trail of Bits Origin Dollar Assessment | 4
/
Project Dashboard
Application Summary
Name Origin Dollar
Version 81431fd
Type Solidity
Platforms Ethereum
Engagement Summary
Dates November 2 - November 17, 2020
Method Whitebox
Consultants Engaged 2
Level of Effort 4 person-weeks
Vulnerability Summary
◼◼◼◼◼◼◼
Total High-Severity Issues 8
◼
Total Medium-Severity Issues 1
◼◼◼◼◼◼
Total Low-Severity Issues 6
Total Informational-Severity Issues 5
◼◼◼◼ ◼
Total Undetermined-Severity Issues 3
◼◼◼
Total 23
Category Breakdown
◼◼◼◼◼◼◼◼
Data Validation 9
◼◼◼◼◼◼◼◼
Undefined Behavior 8
◼
Access Controls 1
◼
Arithmetic 1
◼
Standards 1
◼
Timing 1
◼
Auditing and Logging 1
◼
Denial of Service 1
© 2020 Trail of Bits Origin Dollar Assessment | 5
/
Total 23
© 2020 Trail of Bits Origin Dollar Assessment | 6
/
Code Maturity Evaluation
Category Name Description
Access Controls Weak. We found many issues with privileged roles in the system,
e.g. T OB-OUSD-006 and T OB-OUSD-008.
Arithmetic Weak. Use of SafeMath is inconsistent and untrusted data is not
always validated before being accepted (T OB-OUSD-002 ,
TOB-OUSD-003) . We also discovered several issues due to rounding
errors (T OB-OUSD-022) .
Assembly Use Moderate. A ssembly use is sparse, however, it is used in a way not
conforming to a standard (see T OB-OUSD-005) .
Decentralization Weak. T he governor guardian and other privileged roles hold
substantial power over the system, including the ability to set
system-wide parameters and upgrade implementations.
Upgradeability Moderate. The system partially complies with EIP-1967. See
TOB-OUSD-005.
Function Moderate. T he code is divided into folders with contracts grouped
Composition according to their functionality. The use of Solidity inheritance and
libraries correctly separates different layers of abstraction.
However, the lack of extensive documentation and careful testing
makes