Penetration Test Report (Hacken): Dexe SC Audit Report

SMART CONTRACT CODE
REVIEW AND SECURITY
ANALYSIS REPORT
Customer: DeXe Network
Date: September 24th, 2020
This document may contain confidential information about IT
systems and the intellectual property of the customer as well as
information about potential vulnerabilities and methods of their
exploitation.
The report containing confidential information can be used
internally by the customer or it can be disclosed publicly after
all vulnerabilities fixed - upon a decision of the customer.
Document
Name Smart Contract Code Review and Security Analysis Report for DeXe
Network
Type Token, token-sale, staking.
Platform Ethereum / Solidity
Methods Architecture Review, Functional Testing, Computer-Aided
Verification, Manual Review
Archive Name dexe-8ca55a54680edb[PII_REDACTED]8f1867caf65565b.zip
Checksum c3b6df51f4b88bc7f518c425786a518548d89052153a65310058f7f74057ff18
Timeline 17 SEP 2020 – 20 SEP 2020
Changelog 20 SEP 2020 – Initial Audit
24 SEP 2020 – Secondary review
Table of contents
Introduction.............................................................. 4
Scope..................................................................... 4
Executive Summary......................................................... 5
Severity Definitions...................................................... 6
AS-IS overview............................................................ 7
Audit overview........................................................... 12
Conclusion............................................................... 27
Disclaimers.............................................................. 28
Introduction
Hacken OÜ (Consultant) was contracted by DeXe Network (Customer)
to conduct a Smart Contract Code Review and Security Analysis.
This report presents the findings of the security assessment of
Customer`s smart contract and its code review conducted between
September 17, 2020 – September 20, 2020.
Scope
The scope of the project is smart contracts in the repository:
Audit Archive File – dexe-8ca55a54680edb[PII_REDACTED]8f1867caf65565b.zip
SHA256 checksum -
c3b6df51f4b88bc7f518c425786a518548d89052153a65310058f7f74057ff18
We have scanned this smart contract for commonly known and more
specific vulnerabilities. Here are some of the commonly known
vulnerabilities that are considered:
Category Check Item
Code review ▪ Reentrancy
▪ Ownership Takeover
▪ Timestamp Dependence
▪ Gas Limit and Loops
▪ DoS with (Unexpected) Throw
▪ DoS with Block Gas Limit
▪ Transaction-Ordering Dependence
▪ Style guide violation
▪ Costly Loop
▪ ERC20 API violation
▪ Unchecked external call
▪ Unchecked math
▪ Unsafe type inference
▪ Implicit visibility level
▪ Deployment Consistency
▪ Repository Consistency
▪ Data Consistency
Functional review ▪ Business Logics Review
▪ Functionality Checks
▪ Access Control & Authorization
▪ Escrow manipulation
▪ Token Supply manipulation
▪ Assets integrity
▪ User Balances manipulation
▪ Data Consistency manipulation
▪ Kill-Switch Mechanism
▪ Operation Trails & Event Generation
Executive Summary
According to the assessment, the Customer’s smart contracts are
following code style guides and best practices. All functions are
covered with tested, and the code works as described in the
whitepaper.
Insecure Poor secured Secured Well-secured
You are here
Our team performed an analysis of code functionality, manual
audit, and automated checks with Mythril and Slither. All issues
found during automated analysis were manually reviewed and
important vulnerabilities are presented in the Audit overview
section. A general overview is presented in AS-IS section and all
found issues can be found in the Audit overview section.
Security engineers found 1 medium and 1 low severity issues
during the initial audit. All the issues have been fixed before
secondary audit.
Graph 1. The distribution of vulnerabilities during the initial
audit.
Low
50%
Medium
50%
Medium Low
Severity Definitions
Risk Level Description
Critical vulnerabilities are usually straightforward to
Critical exploit and can lead to assets lose or data
manipulations.
High-level vulnerabilities are difficult to exploit;
however, they also have significant impact on smart
High
contract execution, e.g. public access to crucial
functions
Medium-level vulnerabilities are important to fix;
Medium however, they can’t lead to assets lose or data
manipulations.
Low-level vulnerabilities are mostly related to
Low outdated, unused etc. code snippets, that can’t have
significant impact on execution
Lowest / Code Lowest-level vulnerabilities, code style violations
Style / Best and info statements can’t affect smart contract
Practice execution and can be ignored.
AS-IS overview
PriceFeed.sol
Description
PriceFeed contract serves as a wrapper to receive token prices
from the Uniswap.
Imports
PriceFeed contract has following imports:
• IUniswapV2Pair – from the Uniswap.
• FixedPoint – from the Uniswap
• UniswapV2OracleLibrary – from the Uniswap.
• IPriceFeed – from the project files.
Inheritance
PriceFeed contract implements IPriceFeed.
Structs
PriceFeed contract has no data structures.
Usages
PriceFeed contract uses:
• FixedPoint for *;
Fields
PriceFeed contract has 5 fields and constants:
• address constant USDCAddress =
0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48; - the USDC
contract address from the mainnet.
• IUniswapV2Pair public immutable pair; - the Uniswap pair
address.
• uint public immutable multiplier; - multiplier used to
receive indivisible units as a result.
• uint public priceCumulativeLast; - last price.
• uint32 public blockTimestampLast; - timestamp of a last
update.
Modifiers
PriceFeed contract has no custom modifiers.
Functions
PriceFeed has 4 functions:
• constructor
Description
Initializes contract. Sets a Uniswap pair to provide exchange
rated for.
Visibility
public
Input parameters
o IUniswapV2Pair _pair – uniswap pair.
Constraints
o token0 of the pair should always be USDC.
o The pair should have liquidity on the Unsiwap.
Events emit
None
Output
None
• update
Description
Updates the pair cumulative price and timestamp.
Visibility
public
Input parameters
None
Constraints
None
Events emit
None
Output
o _priceCumulative – cumulative price.
o _blockTimestamp – timestamp.
• consult
Description
Provides exchange rate.
Visibility
external view
Input parameters
None
Constraints
None
Events emit
None
Output
o exchange rate.
• updateAndConsult
Description
Updates the pair cumulative price and provides exchange rate
as a result.
Visibility
external view
Input parameters
None
Constraints
None
Events emit
None
Output
o exchange rate.
Dexe.sol
Description
Dexe is a contract that implements ERC-20 interface and allows to
run token-sale and to provide staking functionality.
Imports
Dexe contract has following imports:
• Ownable – from the OpenZeppelin.
• SafeMath – from the OpenZeppelin.
• ERC20Burnable – from the OpenZeppelin.
• IPriceFeed – from the project files.
• IDexe – from the project files.
Inheritance
Dexe contract implements IDexe and is Ownable and ERC20Burnable.
Structs
Dexe contract has 6 structures:
• LockConfig
• Lock
• HolderRound
• UserInfo
• BalanceInfo
• Round
Usages
Dexe contract uses:
• ExtraMath for *;
• SafeMath for *;
Fields
Dexe contract has 28 fields and constants:
• uint private constant DEXE = 10**18; – DEXE token decimals.
• uint private constant USDC = 10**6; - USDC token decimals.
• uint private constant USDT = 10**6; - USDT token decimals.
• uint private constant DISTRIBUTOR_LIMIT = 10**10 * USDC; - a
distributor first round contribution limit.
• uint private constant MONTH = 30 days; - days in a month.
• uint public constant ROUND_SIZE_BASE = 190_476; - sale round
limit in divisible units.
• uint public constant ROUND_SIZE = ROUND_SIZE_BASE * DEXE; -
sale round limit in indivisible units.
• uint public constant FIRST_ROUND_SIZE_BASE = 1_000_000; -
divider for the first round price calculation.
• IERC20 public usdcToken; - usdc token contract.
• IERC20 public usdtToken; - usdt token co