Penetration Test Report (Hacken): 20210218 Hacken ACryptoSFarmV2

SMART CONTRACT CODE
REVIEW AND SECURITY
ANALYSIS REPORT
Customer: ACryptoS
Date: February 18th, 2021
This document may contain confidential information about IT systems and the
intellectual property of the Customer as well as information about potential
vulnerabilities and methods of their exploitation.
The report containing confidential information can be used internally by the
Customer, or it can be disclosed publicly after all vulnerabilities fixed - upon a
decision of the Customer.
Document
Name Smart Contract Code Review and Security Analysis Report for ACryptoS
Approved by Andrew Matiukhin | CTO Hacken OU
Type Reward pool
Platform Ethereum / Solidity
Methods Architecture Review, Functional Testing, Computer-Aided Verification, Manual
Review
Repository https://github.com/acryptos/acryptos-
protocol/blob/main/farms/ACryptoSFarmV2.sol
Commit https://github.com/acryptos/acryptos-
protocol/commit/8d68ce017f5644b6cd4cd0aa1157bfce6da0e0b1
Deployed
contract
Timeline 15 FEB 2021 – 18 FEB 2021
Changelog 18 FEB 2021 – INITIAL AUDIT
Table of contents
Introduction .............................................................................................................................. 4
Scope ......................................................................................................................................... 4
Executive Summary ................................................................................................................... 5
Severity Definitions ................................................................................................................... 6
AS-IS overview........................................................................................................................... 7
Conclusion ............................................................................................................................... 16
Disclaimers .............................................................................................................................. 17
Introduction
Hacken OÜ (Consultant) was contracted by ACryptoS (Customer) to conduct a
Smart Contract Code Review and Security Analysis. This report presents the
findings of the security assessment of Customer's smart contract and its code
review conducted between February 15th, 2021 – February 18th, 2021.
Scope
The scope of the project is smart contracts in the repository:
Contract deployment address:
Repository: https://github.com/acryptos/acryptos-
protocol/blob/main/farms/ACryptoSFarmV2.sol
Commit:8d68ce017f5644b6cd4cd0aa1157bfce6da0e0b1
Files: ACryptoSFarmV2.sol
We have scanned this smart contract for commonly known and more specific
vulnerabilities. Here are some of the commonly known vulnerabilities that are
considered:
Category Check Item
Code review ▪
Reentrancy
▪
Ownership Takeover
▪
Timestamp Dependence
▪
Gas Limit and Loops
▪
DoS with (Unexpected) Throw
▪
DoS with Block Gas Limit
▪
Transaction-Ordering Dependence
▪
Style guide violation
▪
Costly Loop
▪
ERC20 API violation
▪
Unchecked external call
▪
Unchecked math
▪
Unsafe type inference
▪
Implicit visibility level
▪
Deployment Consistency
▪
Repository Consistency
▪
Data Consistency
Functional review ▪
Business Logics Review
▪
Functionality Checks
▪
Access Control & Authorization
▪
Escrow manipulation
▪
Token Supply manipulation
▪
Assets integrity
▪
User Balances manipulation
▪
Data Consistency manipulation
▪
Kill-Switch Mechanism
▪
Operation Trails & Event Generation
Executive Summary
According to the assessment, the Customer's smart has some issues that should
be fixed.
Insecure Poor secured Secured Well-secured
You are here
Our team performed an analysis of code functionality, manual audit, and
automated checks with Mythril and Slither. All issues found during automated
analysis were manually reviewed, and important vulnerabilities are presented in
the Audit overview section. A general overview is presented in AS-IS section, and
all found issues can be found in the Audit overview section.
Security engineers found 2 informational issues during the audit.
Notice: the audit scope contains 1 contract: ACryptoSFarmV2.sol. Resulting
score may not be considered as score for the whole project.
Graph 1. The distribution of vulnerabilities.
Medium
High
0%
0%
Informational
100%
High Medium Informational
Severity Definitions
Risk Level Description
Critical vulnerabilities are usually straightforward to exploit and can
Critical
lead to assets loss or data manipulations.
High-level vulnerabilities are difficult to exploit; however, they also
High have a significant impact on smart contract execution, e.g., public
access to crucial functions
Medium-level vulnerabilities are important to fix; however, they
Medium
can't lead to assets loss or data manipulations.
Low-level vulnerabilities are mostly related to outdated,
Low unused, etc. code snippets that can't have a significant
impact on execution
Informational / Informational vulnerabilities, code style violations, and info
Code Style / statements can't affect smart contract execution and can be
Best Practice ignored.
AS-IS overview
ACryptoSFarmV2.sol
Description
ACryptoSFarmV2 is a contract used to introduce a pools management and
reward distribution.
Inheritance
ACryptoSFarmV2 contract is OwnableUpgradeable.
Usages
ACryptoSFarmV2 contract has following usages:
• using SafeMathUpgradeable for uint256;
• using SafeERC20Upgradeable for IERC20Upgradeable;
Structs
ACryptoSFarmV2 contract has following structures:
• UserInfo: struct to store data about user and his rewards.
• PoolInfo: struct to store data about pool and its variables.
• AdditionalReward: struct to store data about additional mint parameters
for special rewards.
Enums
• ACryptoSFarmV2 contract has no custom enums.
Events
ACryptoSFarmV2 contract has following custom events:
• Deposit: emit when new deposit has been done.
• Withdraw: emit when user withdraw his funds.
Modifiers
ACryptoSFarmV2 has following modifiers:
• onlyStrategist – checks whether a message sender is the strategist
address or owner address.
Fields and constants
ACryptoSFarmV2 contract has following fields:
• ERC20Mintable public sushi
• uint256 public sushiPerBlock
• address public strategist
• address public harvestFeeAddress
• uint256 public harvestFee
• uint256 public maxBoost
• uint256 public boostFactor
• address public boostToken
• AdditionalReward[] public additionalRewards
• mapping (address => PoolInfo) public poolInfo
• mapping (address=> mapping (address => UserInfo)) public userInfo
• uint256 public totalAllocPoint
ACryptoSFarmV2 contract has following constants:
• uint256 public constant REWARD_DENOMINATOR = 10000
Functions
ACryptoSFarmV2 has following functions:
• pendingSushi
Description
View function to see pending SUSHIs on frontend.
Visibility
External view
Input parameters
o address _lpToken,
o address _user
Constraints
None
Events emit
None
Output
o uint256
• setBoostFactor
Description
Set boost factor.
Visibility
External
Input parameters
o uint256 _boostFactor
Constraints
onlyStrategist
Events emit
None
Output
None
• setMaxBoost
Description
Set max boost factor.
Visibility
External
Input parameters
o uint256 _boostFactor
Constraints
o onlyStrategist
Events emit
None
Output
None
• setHarvestFee
Description
Set harvest fee.
Visibility
External
Input parameters
o uint256 _harvestFee
Constraints
o onlyStrategist
Events emit
None
Output
None
• setHarvestFeeAddress
Description
Set Harvest Fee Address.
Visibility
External
Input parameters
o uint256 _harvestFeeAddress
Constraints
onlyStrategist
Events emit
None
Output
None
• deleteAdditionalRewards
Description
Delete Additional Rewards.
Visibility
External
Input parameters
None
Constraints
o onlyStrategist
Events emit
None
Output
None
• addAdditionalRewards
Description
Add Additional Rewards.
Visibility
External
Input parameters
o address _to,
o uint256 _reward
Constraints
o onlyStrategist
Events emit
None
Output
None
• setStrategist
Description