Skip to main content

Overview

Security Assessment (Summary Report) - March 28, 2024

Audit Scope​

The smart contracts audited can be found on the main branch in the repository: intuition-tob-audit

Audit File​

Security Assessment (Summary Report) - March 28, 2024

Intuition-_Smart_Contracts-_Summary_Report.pdf

Summary of Findings and Fixes​

High Severity​

No high severity issues found

Medium Severity​

  1. Protocol deposit fees unaccounted for in createAtom
  2. Triple identifiers can contain hash collisions
    • Severity: Medium
    • Fixed in: PR#33
  3. Atom equity should be calculated on raw asset amounts
  4. Distributing atom equity should not include protocol fees
  5. Asset accounting should not be reduced by minShare
    • Severity: Medium
    • Fixed in: PR#36

Low Severity​

  1. createAtomCompressed allows creating duplicate atoms with the same URI
  2. Upgrade could lead to mismatch in atom wallet address prediction
  3. createAtom mints sharesForZeroAddress twice
  4. EthMultiVault should not receive ether donations
  5. Atom wallets can be created before the atom is created
  6. Atom URI data is unbounded

Informational Issues​

  1. Salt contains superfluous address(this)
  2. Unbound storage reads in getVaultStates
  3. EthMultiVault is missing ERC-4626 functionality
  4. Redundant and ineffective reinitialization check
  5. Impossible condition
  6. Distributing atom equity should not mint new shares to receiver
  7. getVaultStates does not retrieve counter vaults
  8. Excessive duplicate code
  9. Admin can bypass fee setter limits
  10. Minting ghost shares is unnecessary to prevent share inflation attacks
    • Status: Removed from report
  11. Code Quality
  12. [Weak Maturity] Decentralization
  13. [Weak Maturity] Arithmetic

Status Update​

Last updated: April 3, 2024