Solid World

Smart Contract Security Assessment

Aug 3, 2023

SUMMARY​

ABSTRACT​

Dedaub was commissioned to perform a security audit of the new Zap component of the Solid World protocol. The core Solid World Protocol, which has been audited by Dedaub before, is a set of mechanisms (e.g., tokenization, pooling, and ecosystem reward distribution to stakeholders/liquidity providers) that aim to create and incentivize a liquid market for forward carbon offset agreements.

The most critical subjects covered by this audit are the 3 zap contracts that aim to ease the process of collateralization, decollateralization and staking for the protocol users.

The code and accompanying artifacts (e.g., test suite, documentation) have been developed with high professional standards. No security issues/threats that could lead to theft were identified by the audit. No issues leading to loss of funds resulting from the intended use of the system were identified by the audit.

SETTING & CAVEATS​

The scope of the audit includes a number of new zap contracts. The test suite was consulted during the audit but was not part of it. The full list of audited files is:

solid-world-dao-contracts

The audit report covers commit hash 56f2684ce232345ae1fcb9a4e4ff48bb79750ef5 of the public repository solid-world-dao-contracts. Audited suggested fixes were also reviewed up to commit hash f18289f78168ade370523279c5c87d5e625335f2.

Two auditors worked on the codebase for 3 days.

The audit’s main target is security threats, i.e., what the community understanding would likely call "hacking", rather than the regular use of the protocol. Functional correctness (i.e. issues in "regular use") is a secondary consideration. Typically it can only be covered if we are provided with unambiguous (i.e. full-detail) specifications of what is the expected, correct behavior. In terms of functional correctness, we often trusted the code’s calculations and interactions, in the absence of any other specification. Functional correctness relative to low-level calculations (including units, scaling and quantities returned from external protocols) is generally most effectively done through thorough testing rather than human auditing.

VULNERABILITIES & FUNCTIONAL ISSUES​

This section details issues affecting the functionality of the contract. Dedaub generally categorizes issues according to the following severities, but may also take other considerations into account such as impact or difficulty in exploitation:

Issue resolution includes “dismissed” or “acknowledged” but no action taken, by the client, or “resolved”, per the auditors.

CRITICAL SEVERITY​

[NO CRITICAL SEVERITY ISSUES]

HIGH SEVERITY​

[NO HIGH SEVERITY ISSUES]

MEDIUM SEVERITY​

LOW SEVERITY​

function _sweepETHTo(address zapRecipient)
    private returns (uint sweptAmount)
{
    sweptAmount = IERC20(weth).balanceOf(address(this));
    if (sweptAmount == 0) {
        return 0;
    }

    IWETH(weth).withdraw(sweptAmount);
    (bool success, ) =
        payable(zapRecipient).call{ value: sweptAmount }("");
    if (!success) {
        revert ETHTransferFailed();
    }
}

function _approveTokenSpendingIfNeeded(address token, address spender) internal {
        // Dedaub - Will silently fail if spender already has some allowance.
        if (IERC20(token).allowance(address(this), spender) == 0) {
        // Dedaub - This call will fail if the token does not return a value.
            IERC20(token).approve(spender, type(uint).max);
        }
    }

CENTRALIZATION ISSUES​

It is often desirable for DeFi protocols to assume no trust in a central authority, including the protocol’s owner. Even if the owner is reputable, users are more likely to engage with a protocol that guarantees no catastrophic failure even in the case the owner gets hacked/compromised. We list issues of this kind below. (These issues should be considered in the context of usage/deployment, as they are not uncommon. Several high-profile, high-value protocols have significant centralization threats.)

[NO CENTRALISATION ISSUES]

OTHER / ADVISORY ISSUES​

This section details issues that are not thought to directly affect the functionality of the project, but we recommend considering them.

DISCLAIMER​

The audited contracts have been analyzed using automated techniques and extensive human inspection in accordance with state-of-the-art practices as of the date of this report. The audit makes no statements or warranties on the security of the code. On its own, it cannot be considered a sufficient assessment of the correctness of the contract. While we have conducted an analysis to the best of our ability, it is our recommendation for high-value contracts to commission several independent audits, a public bug bounty program, as well as continuous security auditing and monitoring through Dedaub Security Suite.

ABOUT DEDAUB​

Dedaub offers significant security expertise combined with cutting-edge program analysis technology to secure some of the most prominent protocols in DeFi. The founders, as well as many of Dedaub's auditors, have a strong academic research background together with a real-world hacker mentality to secure code. Protocol blockchain developers hire us for our foundational analysis tools and deep expertise in program analysis, reverse engineering, DeFi exploits, cryptography and financial mathematics.