Overview

Security Assessment (Summary Report) - March 28, 2024

Audit Scope

The smart contracts audited can be found on the main branch in the repository: intuition-tob-audit

Audit File

Security Assessment (Summary Report) - March 28, 2024

Intuition-_Smart_Contracts-_Summary_Report.pdf

Summary of Findings and Fixes

High Severity

No high severity issues found

Medium Severity

1. Protocol deposit fees unaccounted for in createAtom
   • Severity: Medium
   • Fixed in: commit#edc4584
2. Triple identifiers can contain hash collisions
   • Severity: Medium
   • Fixed in: PR#33
3. Atom equity should be calculated on raw asset amounts
   • Severity: Medium
   • Fixed in: commit#028748d
4. Distributing atom equity should not include protocol fees
   • Severity: Medium
   • Fixed in: commit#028748d
5. Asset accounting should not be reduced by minShare
   • Severity: Medium
   • Fixed in: PR#36

Low Severity

1. createAtomCompressed allows creating duplicate atoms with the same URI
   • Fixed in: commit#4d0b2ba from PR#30
2. Upgrade could lead to mismatch in atom wallet address prediction
   • Fixed in: PR#38
3. createAtom mints sharesForZeroAddress twice
   • Fixed in: commit#edc4584
4. EthMultiVault should not receive ether donations
   • Fixed in: PR#24
5. Atom wallets can be created before the atom is created
   • Fixed in: PR#29
6. Atom URI data is unbounded
   • Fixed in: PR#32

Informational Issues

1. Salt contains superfluous address(this)
   • Fixed in: PR#27
2. Unbound storage reads in getVaultStates
   • Fixed in: PR#25
3. EthMultiVault is missing ERC-4626 functionality
   • Status: Addressed in comments
4. Redundant and ineffective reinitialization check
   • Fixed in: PR#28
5. Impossible condition
   • Fixed in: PR#26
6. Distributing atom equity should not mint new shares to receiver
   • Fixed in: PR#39
7. getVaultStates does not retrieve counter vaults
   • Fixed in: PR#25
8. Excessive duplicate code
   • Fixed in: PR#30
9. Admin can bypass fee setter limits
   • Fixed in: PR#34
10. Minting ghost shares is unnecessary to prevent share inflation attacks
    • Status: Removed from report
11. Code Quality
    • Fixed in: PR#40 and PR#41
12. [Weak Maturity] Decentralization
    • Fixed in: PR#42 and PR#45
13. [Weak Maturity] Arithmetic
    • Status: Addressed in comments

Status Update

Last updated: April 3, 2024