ElasticDAO Smart Contract and Security Audits
Tags: Solidity, Ethereum, Fairgovernance, Security, Dao

Jellies… safe and sound

ElasticDAO Contracts: https://github.com/elasticdao/contracts

The core development team has been working hard on the contracts since August of 2020. We are very proud of the work we’ve done and believe that we’ve created something very special. We have gone and will continue to go to great lengths to ensure that the contracts are safe and well tested. Our process includes having friends review the code, running code contests on Code 423n4 (which I like to call a super-audit), engaging outside expertise to verify the math, and running a bounty program for bugs discovered in the wild. We are also in talks with several audit firms to create an ongoing relationship.

This article aims to provide full transparency around our process and update everyone, in detail, on what has happened so far. This article will be followed up shortly with a proposal to the community to ratify certain aspects of the approach.

Code 423n4 Contest

As some of you know, before teaming up on ElasticDAO, I was heading up tech at PieDAO. In April of 2020, shortly after the launch of BTC++, the imBTC Uniswap V1 pool was compromised. The hacker took advantage of a known issue (reentrancy attack) related to the ERC721 standard and UNI-V1 pools. At the time, I toyed with forming a DAO, AuditDAO, to actively scan Ethereum for issues and provide other audit services to early-stage projects. The telegram group quickly grew and still includes many of the top names in the audit space, but the project never went anywhere due, I believe, to lack of interest and time.

One thing that did come out of this was lengthy discussions with Scott Lewis about a contest-type platform focused on providing audits more efficiently. So, when he reached out to me on February 8th to tell me about the pending launch of Code 423n4, I jumped on the chance to have ElasticDAO’s contracts vetted.

Our contest started on February 25th, backed by a prize pool of 20 ETH (plus 2 ETH for gas optimizations and 2 ETH for judging). Seven teams of wardens found 27 unique bugs, 7 of which were of high severity, and 10 optimizations. Our team sprang into action and addressed and resolved all of these issues within a week.

This result far exceeded previous experiences I’ve had with 2–4 week-long audits by individual companies. In an earlier project which I was a part of, the traditional style audit left 11 severe and medium bugs undiscovered for months. I highly recommend the Code 423n4 competitive audit approach for anyone starting a new project and propose that we use it again in the future as we roll out new smart contracts.

Reenactment: SSDD after 2 days of justifying his math to half a dozen other people

Math Validation

One of the issues identified by the wardens referenced a reported GitHub issue with the implementation of wmul that we used. It seemed like we may have a rather critical problem with the calculations, so we sounded alarm bells through our network to find math geniuses to assist. Aaron, a friend of mine who has a lot of experience in financial math, stepped in and began to review. A friend of Scoopy Trooples, Trakanom, also rode to the rescue. We were also able to engage the team who wrote the original wmul implementation. Trakanom, in particular, was incredibly helpful in working through the details of the issue and generally vetting the rest of our math. These highly talented people were able to conclude that SSDD was correct and the reported issue was invalid.

Launch and attempts to break protections

Armed with the results of the audits, the vetting of the math, and our knowledge that in a worst-case scenario, we could update our contract implementations, we decided to launch to mainnet.

Our launch had typical hiccups. We underestimated the amount of time we would need to deploy and test everything before announcing. Some enterprising dark forest members found the contracts via their bytecode and attempted to join and summon our initial DAO before it was ready. Our brand new hardware wallets had some software issues and had to be swapped out with others. Thankfully the protections we had put into place worked. All that the early would-be attackers accomplished was donating 0.55 ETH to the DAO.

Unfortunately, with our focus entirely on the code and launch, we overlooked our Discord server settings. A scammer was able to masquerade as our team member, AlleyCat, and “announce” our DAO with a fake medium article directing people to send ETH directly to his address. The scammer made off with 23.8 ETH, which we chose to refund to the victimized wallets.

The launch was a fantastic success. Participants used 2069 ETH to mint just over 30,000 EGT, and the sushiswap pool saw over $6m in trading volume within the first day.

Then it happened

The team woke up 2 days after launch to friend requests from samczsun and a dozen pings from Tina Zhen, which generated the expected panic level. As we waited for his report, we began gaming out what it could be. Thankfully he got back to us very quickly with a creative way to attack the transfer function. The bug allowed an attacker to mint duplicate EGT tokens, facilitating the potential draining of the SushiSwap pool, among other things. The fix was a simple guard added to the transfer function that neither the team nor the wardens had anticipated necessary. $900,000 worth of EGT and ETH saved in the SushiSwap pool, and $3,500,000 in the vault, saved thanks to Ethereum’s most prolific white hat.

Tally and thanks

We’ve spent heavily on security for obvious reasons. The choice to do so has protected well over $5,000,000 worth of community assets. The core team is very grateful to the community for backing us in ELIP #1 and voting to refund the related out-of-pocket costs.

We take security very seriously and will continue to do everything within our power to protect our members’ funds. Presuming the community agrees to the costs associated, we will continue to run our solidity code through Code 423n4 contests or traditional audits as available.

Many thanks to all of the people who helped.

The team at Code 423n4 — Scott Lewis, Zak Cole, and others

Our friends who reviewed the contracts — Phil Elsasser, Mick DeGraf, and others

Our friends who reviewed the math — Aaron, David, Trakanom, and others

Of course, to samczsun.

And to our community who have supported us from the beginning.