Penetration Test Report (Hacken): 03042021 Kalmar SC Audit Report

SMART CONTRACT
CODE REVIEW AND
SECURITY ANALYSIS
REPORT
Customer: Kalmar
Date: April 3rd, 2021
This document may contain confidential information about IT systems and the
intellectual property of the Customer as well as information about potential
vulnerabilities and methods of their exploitation.
The report containing confidential information can be used internally by the
Customer, or it can be disclosed publicly after all vulnerabilities fixed - upon a
decision of the Customer.
Document
Name Smart Contract Code Review and Security Analysis Report for Kalmar.
Approved by Andrew Matiukhin | CTO Hacken OU
Type Sale
Platform Ethereum / Solidity
Methods Architecture Review, Functional Testing, Computer-Aided Verification, Manual
Review
Repository HTTPS://GITHUB.COM/KALMAR-IO/LEVERAGE-YIELD-CONTRACTS
Commit AD08AEF5A2281639A3226F31D4D8D5AABA73967E
Timeline 23 MAR 2021 – 3 APR 2021
Changelog 3 APR 2021 – INITIAL AUDIT
Table of contents
Introduction .......................................................................................................................... 4
Scope .................................................................................................................................... 4
Executive Summary ............................................................................................................... 5
Severity Definitions ............................................................................................................... 7
AS-IS overview ...................................................................................................................... 8
Conclusion .......................................................................................................................... 18
Disclaimers .......................................................................................................................... 19
Introduction
Hacken OÜ (Consultant) was contracted by Kalmar (Customer) to conduct a
Smart Contract Code Review and Security Analysis. This report presents the
findings of the security assessment of Customer's smart contract and its code
review conducted between March 23rd, 2021 – April 3rd, 2021.
Scope
The scope of the project is smart contracts in the repository:
Repository: https://github.com/kalmar-io/leverage-yield-contracts
Files:
Bank.sol
BankConfig.sol
ConfigurableInterestBankConfig.sol
Goblin.sol
GoblinConfig.sol
MasterChefGoblin.sol
MasterChefGoblinConfig.sol
MasterChefPoolRewardPairGoblin.sol
SafeToken.sol
SimpleBankConfig.sol
SimplePriceOracle.sol
StrategyAllETHOnly.sol
StrategyAddTwoSidesOptimal.sol
StrategyLiquidate.sol
StrategyWithdrawMinimizeTrading.sol
We have scanned this smart contract for commonly known and more specific
vulnerabilities. Here are some of the commonly known vulnerabilities that are
considered:
Category Check Item
Code review ▪ Reentrancy
▪ Ownership Takeover
▪ Timestamp Dependence
▪ Gas Limit and Loops
▪ DoS with (Unexpected) Throw
▪ DoS with Block Gas Limit
▪ Transaction-Ordering Dependence
▪ Style guide violation
▪ Costly Loop
▪ ERC20 API violation
▪ Unchecked external call
▪ Unchecked math
▪ Unsafe type inference
▪ Implicit visibility level
▪ Deployment Consistency
▪ Repository Consistency
▪ Data Consistency
Functional review ▪ Business Logics Review
▪ Functionality Checks
▪ Access Control & Authorization
▪ Escrow manipulation
▪ Token Supply manipulation
▪ Assets integrity
▪ User Balances manipulation
▪ Kill-Switch Mechanism
▪ Operation Trails & Event Generation
Executive Summary
According to the assessment, the Customer's smart contracts are secure.
Insecure Poor secured Secured Well-secured
You are
Our team performed an analysis of code functionality, manual audit, and
here
automated checks with Mythril and Slither. All issues found during automated
analysis were manually reviewed, and important vulnerabilities are presented in
the Audit overview section. A general overview is presented in AS-IS section, and
all found issues can be found in the Audit overview section.
Security engineers found 2 medium, 2 low and 1 informational issue during the
audit.
Notice: the code is provided without tests and build configs. This complicates
review process.
Graph 1. The distribution of vulnerabilities after the first review.
Informational
20%
Medium
40%
Low
40%
Medium Low Informational
Severity Definitions
Risk Level Description
Critical vulnerabilities are usually straightforward to exploit and can
Critical
lead to assets loss or data manipulations.
High-level vulnerabilities are difficult to exploit; however, they also
High have a significant impact on smart contract execution, e.g., public
access to crucial functions
Medium-level vulnerabilities are important to fix; however, they
Medium
can't lead to assets loss or data manipulations.
Low-level vulnerabilities are mostly related to outdated, unused,
Low etc. code snippets that can't have a significant impact on
execution
Informational / Informational vulnerabilities, code style violations, and info
Code Style / statements can't affect smart contract execution and can be
Best Practice ignored.
AS-IS overview
Bank.sol
Description
Bank is the ERC-20 token that also acts as coin storage and main gateway to
goblins.
Imports
Bank has following imports:
• import "openzeppelin-solidity-2.3.0/contracts/ownership/Ownable.sol"
• import "openzeppelin-solidity-2.3.0/contracts/token/ERC20/ERC20.sol"
• import "openzeppelin-solidity-2.3.0/contracts/math/SafeMath.sol"
• import "openzeppelin-solidity-2.3.0/contracts/math/Math.sol"
• import "openzeppelin-solidity-
2.3.0/contracts/utils/ReentrancyGuard.sol"
• import "./BankConfig.sol"
• import "./Goblin.sol"
• import "./SafeToken.sol"
Inheritance
Bank is ERC20, ReentrancyGuard, Ownable.
Usages
Bank contract has following usages:
• SafeMath for uint256.
• SafeToken for address.
Structs
Bank contract has following data structures:
• Position
Enums
Bank contract has no custom enums.
Events
Bank contract has following events:
• event AddDebt(uint256 indexed id, uint256 debtShare)
• event RemoveDebt(uint256 indexed id, uint256 debtShare)
• event Work(uint256 indexed id, uint256 loan)
• event Kill(uint256 indexed id, address indexed killer, uint256 prize,
uint256 left)
Modifiers
Bank has following modifiers:
• onlyEOA – require that the caller must be an EOA account to avoid flash
loans.
• Accrue – add more debt to the global debt pool.
Fields
Bank contract has following fields and constants:
• string public name = "Interest Bearing BNB"
• string public symbol = "iBNB"
• uint8 public decimals = 18
• BankConfig public config
• mapping (uint256 => Position) public positions
• uint256 public nextPositionID = 1
• uint256 public glbDebtShare
• uint256 public glbDebtVal
• uint256 public lastAccrueTime
• uint256 public reservePool
Functions
Bank has following public and external functions:
• constructor
Description
Initializes the contract.
Input parameters
o BankConfig _config
Constraints
None
Events emit
None
Output
None
• pendingInterest, debtShareToVal, debtValToShare, positionInfo,
totalETH
Description
View functions
• deposit
Description
Deposits ETH. Mints tokens instead.
Input parameters
None
Constraints
None
Events emit
None
Output
None
• withdraw
Description
Withdraws ETH. Burns tokens instead.
Input parameters
o uint256 share
Constraints
None
Events emit
None
Output
None
• work
Description
Create a new farming position.
Input parameters
o uint256 id
o address goblin
o uint256 loan
o uint256 maxReturn
o bytes calldata data
Constraints
o onlyEOA modifier.
o id should be valid.
o goblin address should be authorized goblin.
o loan should be 0 or debt should be allowed by config.
Events emit
Emits Work event
Output
None
• kill
Description
Kill a position if requirements are met.
Input parameters
o uint256 id
Constraints
o debtShare should be more than 0.
o Kill factor conditions should be met.
Events emit
Emits Killevent
Output
None
• updateConfig, withdrawReserve, reduceReserve