Penetration Test Report (Red4Sec): Polkamarkets Security Audit Report v3

Polkamarkets Smart Contract Audit
Smart Contract Security Audit
Polkamarkets
2021-11-04
RED4SEC Page 1
Polkamarkets Smart Contract Audit
1. Introduction ..................................................... 3
2. Disclaimer ....................................................... 3
3. Scope .............................................................. 3
4. Conclusions ...................................................... 4
5. Issues and Recommendations ............................ 6
PMSC01 – Missing Ranges Check ........................................ 6
PMSC02 – Improvable Comparisons .................................... 7
PMSC03 – Lack of Inputs Validation ..................................... 7
PMSC04 – Reentrancy........................................................ 9
PMSC05 – Comment Mismatch .......................................... 10
PMSC06 – Use of Require Statement without Message ......... 10
PMSC07 – Outdated Compiler Version ................................ 11
PMSC08 – GAS Optimization ............................................. 11
PMSC09 – Code Style ...................................................... 15
RED4SEC Page 2
Polkamarkets Smart Contract Audit
1. Introduction
Polkamarkets is a DeFi-Powered Prediction Market built for cross-chain
information exchange and trading where users can take positions on outcomes of
real-world events in a decentralized and interoperable platform based on
Polkadot.
Polkamarkets aims to solve the low usage & volume problems by incentivising
liquidity providers and traders to facilitate & take large positions, while a system
for curation and resolution ensures efficient and trustworthy markets.
As requested by Polkamarkets and as part of the vulnerability review and
management process, Red4Sec has been asked to perform a security code audit
in order to evaluate the security of the Prediction Market smart contract.
2. Disclaimer
This document only represents the results of the code audit conducted by
Red4Sec Cybersecurity and should not be used in any way to make investment
decisions or as investment advice on a project.
Likewise, the report should not be considered neither "endorsement" nor
"disapproval" of the guarantee of the correct business model of the analyzed
project.
3. Scope
The scope of this evaluation includes the following smart contract:
• PredictionMarket.sol
SHA256: D92D7A29F601BD4EAB0452254F6FB59F5DF843EC1AB510E64AB07D0F1678F194
The fixes applied were address in the following repository:
• https://github.com/bepronetwork/bepro-js/tree/feature/prediction-markets-
red4sec-changes
RED4SEC Page 3
Polkamarkets Smart Contract Audit
4. Conclusions
To this date, 4th of November 2021, the general conclusion resulting from the
conducted audit is that Polkamarket’s smart contract is secure.
Nevertheless, there are a few highlights and possible improvements worth
mentioning, these do not pose any risk by themselves, and we have classified
such issues as informative only, but they will help Polkamarkets to continue to
improve the security and quality of the project.
• Some methods do not make the necessary input checks in order to
guarantee the integrity and expected arguments format.
• The proper functioning of the PredictionMarket relies on external
contracts (RealitioERC20) which are out of scope in the current audit, as
well as the responsibility to properly resolve the markets.
• The work and collaboration by the Polkamarkets technical team has been
excellent since the beginning of the audit, solving some of the issues in a
short period of time.
• A few of the found issues in the audit have been reviewed and
corrected by the Polkamarkets team and subsequently reviewed and
verified by the Red4Sec team. As communicated by the client, the
assumed issues will be applied in version 2 of the protocol
Found issues have been classified in the following levels of risk according to the
impact level defined by CVSS v3 (Common Vulnerability Scoring System) by the
National Institute of Standards and Technology (NIST).
VULNERABILITY SUMMARY
Critical
High
Medium
Low
Informative
0 1 2 3 4 5 6 7 8 9
RED4SEC Page 4
Polkamarkets Smart Contract Audit
Below we have a complete list of the issues detected by Red4Sec, presented
and summarized in a way that can be used for risk management and mitigation.
A continuous process was created during the audit in order to improve the
security of the PredictionMarket project. Polkamarkets’s team has fixed some
issues detailed in this report and the current status of the contract, after the
review made by the Red4Sec team, is as follows:
Table of vulnerabilities
Id. Vulnerability Risk State
PMSC01 Missing Ranges Check Low Fixed
PMSC02 Improvable Comparisons Low Fixed
PMSC03 Lack of Inputs Validation Low Partially
PMSC04 Reentrancy Attack Low Assumed
PMSC05 Comment Mismatch Informative Fixed
PMSC06 Use of Require statement without message Informative Fixed
PMSC07 Outdated Compiler Version Informative Assumed
PMSC08 GAS Optimization Informative Assumed
PMSC09 Code Style Informative Assumed
RED4SEC Page 5
Polkamarkets Smart Contract Audit
5. Issues and Recommendations
PMSC01 – Missing Ranges Check (Low)
Every time we carry out operations or receive external values, which are expected
to be in a certain range of values, it is convenient to verify that the result of the
operations is always within the mentioned range.
This is the case of outcomeId received from the external call to realitio where the
result should be verified to be 0 or 1.
The nextState function should also verify that the resulting state never exceeds
2 or the function would fail.
Source reference
• PredictionMarket.sol: 500, 651
The correction has been applied in the following commit:
• https://github.com/bepronetwork/bepro-
js/commit/194fcd6e95f7ebfe1ffbaf8885afd67e2ca79c19
RED4SEC Page 6
Polkamarkets Smart Contract Audit
PMSC02 – Improvable Comparisons (Low)
There are two require in the createMarket method that must be improved, first it
should be verified that the closesAt variable is greater, not greater or equal, to
avoid that the same transaction creates a market and closes, this behaviour could
allow a flash loan to perform unexpected actions.
Secondly, the arbitrator variable must be checked to be different from
address(0), not equal to itself.
Additionally, in the buy and sell methods there should be verification stating that
shares > 0, this will prevent unwanted shares, under certain circumstances (fee
= 0), with accounts that do not have or will not have shares.
Source reference
• PredictionMarket.sol: 192, 193, 293
The correction has been applied in the following commit:
• https://github.com/bepronetwork/bepro-
js/commit/362bcecb41a06a3858647f2ce3eaf48c44a4252d
PMSC03 – Lack of Inputs Validation (Low)
Some methods of the different contracts in the Polkamarkets project do not
properly check the arguments, which can lead to major errors. Below we list the
most significant examples.
• During the logic of the constructor in the contract, none of the received
arguments are verified. For example, fee, _requiredBalance,
_realitioTimeout, … to be greater than zero.
Source reference
o PredictionMarket.sol: 161
• Additionally, it is recommended to verify the value of the variable
realtioTimeout in the constructor, since the value must be more than 0 and
RED4SEC Page 7
Polkamarkets Smart Contract Audit
less than 365 days, as can be seen in the following require within the
_askQuestion method of the RealitioERC20 contract.
Source reference
o PredictionMarket.sol: 168
The correction has been applied in the following commit:
• https://github.com/bepronetwork/bepro-
js/commit/e668338ab4fee9cc2ba87cdda6fc10fcac4cf51a
• In some methods of the Polkamarkets project, the marketId value sent
through the arguments is not checked to be valid, so it allows the use of
non-existent marketId, it is recommended to use the isMarket modifier
provided for this.
• These methods should reverse the execution in case the market do