Penetration Test Report (Hacken): Hacken SONM Security Audit

Smart Contract Code Review and Security Analysis Report
Customer: SONM
Date: July 13, 18
This document contains confidential information about IT systems and
intellectual properties of the customer, as well as information about potential
vulnerabilities and methods of their exploitation.
This confidential information is for internal use by the customer only and
shall not be disclosed to third parties.
Document:
Name: Smart Contract Code Review and Security
Analysis Report for SONM
Date: 13.07.2018
Table of contents
Introduction ................................................................................................................................................................ 3
Scope............................................................................................................................................................................ 3
Executive Summary ................................................................................................................................................ 5
Severity Definitions ................................................................................................................................................. 5
AS-IS overview ........................................................................................................................................................ 6
Audit overview ...................................................................................................................................................... 10
Conclusion .............................................................................................................................................................. 12
Disclaimers ............................................................................................................................................................. 12
Appendix A. Evidences ....................................................................................................................................... 13
Appendix B. Automated tools reports ............................................................................................................. 17
Introduction
Hacken OÜ (Consultant) was contracted by SONM (Customer) to conduct a Smart Contract Code
Review and Security Analysis. This report presents the findings of the security assessment of
Customer`s smart contract and its code review conducted between June 28th, 2018 - July 13th, 2018.
Scope
The scope of the project is SONM smart contracts, which can be found on github by links below:
• Blacklist
https://github.com/sonm-io/core/blob/master/blockchain/source/contracts/Blacklist.sol
• ProfileRegistry
https://github.com/sonm-io/core/blob/master/blockchain/source/contracts/ProfileRegistry.sol
• OracleUSD
https://github.com/sonm-io/core/blob/master/blockchain/source/contracts/OracleUSD.sol
• SNM
https://github.com/sonm-io/core/blob/master/blockchain/source/contracts/SNM.sol
• SimpleGatekeeperWithLimit
https://github.com/sonm-
io/core/blob/master/blockchain/source/contracts/SimpleGatekeeperWithLimit.sol
• SimpleGatekeeperWithLimitLive
https://github.com/sonm-
io/core/blob/master/blockchain/source/contracts/SimpleGatekeeperWithLimitLive.sol
Commit 4ccf67358be704f76be54dd28d85cbd4cc801a43
We have scanned this smart contract for commonly known and more specific vulnerabilities. Here
are some of the commonly known vulnerabilities that are considered (the full list includes them but
is not limited to them):
• Reentrancy
• Timestamp Dependence
• Gas Limit and Loops
• DoS with (Unexpected) Throw
• DoS with Block Gas Limit
• Transaction-Ordering Dependence
• Byte array vulnerabilities
• Style guide violation
• Transfer forwards all gas
• ERC20 API violation
• Malicious libraries
• Compiler version not fixed
• Unchecked external call - Unchecked math
• Unsafe type inference
• Implicit visibility level
Executive Summary
According to the assessment, Customer`s smart contracts are well secured and have only some low
security issues that can’t have significant impact on security.
Our team performed analysis of code functionality, manual audit and automated checks with solc,
Mythril and remix IDE (see Appendix B pic 1-27). All found issues during automated analysis were
manually reviewed and applicable vulnerabilities are presented in Audit Overview section. General
overview is presented in AS-IS section and all found issues can be found in Audit overview section.
We found 2 low-level vulnerabilities, outlined 3 important informational statements and 1 сode style
issue.
Graph 1. Vulnerabilities distribution
Code style
violations
13% Low
25%
Info
62%
Low Info Code style violations
Severity Definitions
Risk Level Description
Critical vulnerabilities are usually straightforward to exploit and can lead to
Critical
tokens lose etc.
High-level vulnerabilities are difficult to exploit; however, they also have
High significant impact on smart contract execution, e.g. public access to crucial
functions
Medium-level vulnerabilities are important to fix; however, they can’t lead
Medium
to tokens lose
Low-level vulnerabilities are mostly related to outdated, unused etc.
Low
code snippets, that can’t have significant impact on execution
Lowest / Code Lowest-level vulnerabilities, code style violations and info statements
Style / Info can’t affect smart contract execution and can be ignored.
AS-IS overview
SNM contract overview
SNM.sol contract describes custom ERC20 token with next parameters:
• name – SONM token
• symbol – SNM
• decimals – 18
SNM contract constructor sets:
• totalSupply_ to 444 * 1e6 * 1e18
• balances[msg.sender] to totalSupply_
Blacklist contract overview
Blacklist contract constructor sets:
• owner to a msg.sender
Blacklist.sol has 1 modifier:
• OnlyMarket – checks if market is not 0x0; checks if msg.sender is a market or msg.sender is
a master.
Blacklist.sol has 6 functions:
• Check – checks if person is in a blacklist
• Add – adds provided address to a blacklist. Has onlyMarket modifier.
• Remove – removes provided address from a blacklist.
• AddMaster – adds master. Has onlyOwner modifier.
• RemoveMaster – removes master. Has onlyOwner modifier.
• SetMarketAddress– sets market address to a specified address. Has onlyOwner modifier.
Market contract overview
Market contract constructor sets:
• token to SNM(_token)
• bl to Blacklist(_blacklist)
• oracle to OracleUSD(_oracle)
• pr to ProfileRegistry(_profileRegistry)
• benchmarksQuantity to _benchmarksQuantity
• netflagsQuantity to _netflagsQuantity
Market.sol has 37 functions:
• PlaceOrder – creates order on the market.
• CancelOrder – cancels order with ORDER_ACTIVE status.
• QuickBuy – creates an Ask order and calls OpenDeal.
• OpenDeal – opens the deal with a specified dealID.
• CloseDeal – closes the deal with a specified dealID.
• Bill – makes payments on the transaction..
• CreateChangeRequest – creates a new ChangeRequest, if there is a similar one on the other
hand (Supplier or Customer), the transaction conditions change..
• CancelChangeRequest – changes RequesStatus to a REQUEST_CANCELED or
REQUEST_REJECTED.
• RegisterWorker – registers the transaction author as Worker for the specified master.
• ConfirmWorker – confirms registration of the specified worker for the master - the author of
the transaction.
• RemoveWorker – removes the specified worker for the specified master.
• GetOrderInfo – returns information about the order with a specified orderID.
• GetOrderParams – returns orderStatus and dealID about the order with a specified orderID.
• GetDealInfo – returns information about the deal with a specified dealID.
• GetDealParams – returns parameters for the deal with a specified dealID.
• GetMaster – returns the specified master Worker. Returns Worker, if the master is not
specified.
• GetChangeRequestInfo – returns information about the change request with a specified
changeRequestID.
• GetDealsAmount – returns dealAmount.
•