Skip to content

aderyn-report.md

Latest commit

 

History

History
475 lines (294 loc) · 13.2 KB

aderyn-report.md

File metadata and controls

475 lines (294 loc) · 13.2 KB
Raw

Aderyn Analysis Report

This report was generated by Aderyn, a static analysis tool built by Cyfrin, a blockchain security company. This report is not a substitute for manual audit or security review. It should not be relied upon for any purpose other than to assist in the identification of potential security vulnerabilities.

Table of Contents

Summary

Files Summary

Key Value
.sol Files 19
Total nSLOC 754

Files Details

Filepath nSLOC
contracts/base/CMTATInternalSnapshotBase.sol 109
contracts/base/SnapshotEngineBase.sol 29
contracts/deployment/CMTATStandaloneInternalSnapshot.sol 18
contracts/deployment/CMTATUpgradeableInternalSnapshot.sol 7
contracts/deployment/SnapshotEngine.sol 26
contracts/deployment/SnapshotEngineOwnable2Step.sol 11
contracts/interface/IERC20SnapshotCompatible.sol 5
contracts/interface/ISnapshotBase.sol 28
contracts/interface/ISnapshotScheduler.sol 9
contracts/interface/ISnapshotState.sol 11
contracts/library/Errors.sol 6
contracts/library/SnapshotBase.sol 298
contracts/library/SnapshotStateInternal.sol 48
contracts/mock/CMTAT_EXTERNAL_SNAPSHOT_STANDALONE_MOCK.sol 20
contracts/mock/CMTAT_STANDALONE_MOCK.sol 21
contracts/modules/SnapshotSchedulerModule.sol 37
contracts/modules/SnapshotStateModule.sol 37
contracts/modules/SnapshotUpdateModule.sol 20
contracts/modules/VersionModule.sol 14
Total 754

Issue Summary

Category No. of Issues
High 2
Low 7

High Issues

H-1: Arbitrary from Passed to transferFrom

Passing an arbitrary from address to transferFrom (or safeTransferFrom) can lead to loss of funds, because anyone can transfer tokens from the from address if an approval is made.

1 Found Instances

  • Found in contracts/base/CMTATInternalSnapshotBase.sol Line: 118

             return CMTATBaseCommon.transferFrom(from, to, value);

H-2: Contract Name Reused in Different Files

When compiling contracts with certain development frameworks (for example: Truffle), having contracts with the same name across different files can lead to one being overwritten.

1 Found Instances

  • Found in contracts/modules/VersionModule.sol Line: 8

     abstract contract VersionModule is IERC3643Version {

Low Issues

L-1: Centralization Risk

Contracts have owners with privileged rights to perform admin tasks and need to be trusted to not perform malicious updates or drain funds.

5 Found Instances

  • Found in contracts/base/CMTATInternalSnapshotBase.sol Line: 160

         function _authorizeSnapshot() internal virtual override onlyRole(SNAPSHOOTER_ROLE) {

  • Found in contracts/deployment/SnapshotEngine.sol Line: 15

     contract SnapshotEngine is SnapshotEngineBase, AccessControlEnumerable {

  • Found in contracts/deployment/SnapshotEngine.sol Line: 43

         function _authorizeSnapshot() internal virtual override onlyRole(SNAPSHOOTER_ROLE) {

  • Found in contracts/deployment/SnapshotEngineOwnable2Step.sol Line: 12

     contract SnapshotEngineOwnable2Step is SnapshotEngineBase, Ownable2Step {

  • Found in contracts/deployment/SnapshotEngineOwnable2Step.sol Line: 18

         function _authorizeSnapshot() internal virtual override onlyOwner {

L-2: Unsafe ERC20 Operation

ERC20 functions may not behave as expected. For example: return values are not always meaningful. It is recommended to use OpenZeppelin's SafeERC20 library.

2 Found Instances

  • Found in contracts/base/CMTATInternalSnapshotBase.sol Line: 109

             return CMTATBaseCommon.transfer(to, value);

  • Found in contracts/base/CMTATInternalSnapshotBase.sol Line: 127

             return CMTATBaseRuleEngine.approve(spender, value);

L-3: Unspecific Solidity Pragma

Consider using a specific version of Solidity in your contracts instead of a wide version. For example, instead of pragma solidity ^0.8.0;, use pragma solidity 0.8.0;

18 Found Instances

  • Found in contracts/base/CMTATInternalSnapshotBase.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/base/SnapshotEngineBase.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/deployment/CMTATStandaloneInternalSnapshot.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/deployment/CMTATUpgradeableInternalSnapshot.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/deployment/SnapshotEngine.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/deployment/SnapshotEngineOwnable2Step.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/interface/IERC20SnapshotCompatible.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/interface/ISnapshotBase.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/interface/ISnapshotScheduler.sol Line: 2

     pragma solidity ^0.8.0;

  • Found in contracts/interface/ISnapshotState.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/library/SnapshotBase.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/library/SnapshotStateInternal.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/mock/CMTAT_EXTERNAL_SNAPSHOT_STANDALONE_MOCK.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/mock/CMTAT_STANDALONE_MOCK.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/modules/SnapshotSchedulerModule.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/modules/SnapshotStateModule.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/modules/SnapshotUpdateModule.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/modules/VersionModule.sol Line: 3

     pragma solidity ^0.8.20;

L-4: PUSH0 Opcode

Solc compiler version 0.8.20 switches the default target EVM version to Shanghai, which means that the generated bytecode will include PUSH0 opcodes. Be sure to select the appropriate EVM version in case you intend to deploy on a chain other than mainnet like L2 chains that may not support PUSH0, otherwise deployment of your contracts will fail.

19 Found Instances

  • Found in contracts/base/CMTATInternalSnapshotBase.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/base/SnapshotEngineBase.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/deployment/CMTATStandaloneInternalSnapshot.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/deployment/CMTATUpgradeableInternalSnapshot.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/deployment/SnapshotEngine.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/deployment/SnapshotEngineOwnable2Step.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/interface/IERC20SnapshotCompatible.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/interface/ISnapshotBase.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/interface/ISnapshotScheduler.sol Line: 2

     pragma solidity ^0.8.0;

  • Found in contracts/interface/ISnapshotState.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/library/Errors.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/library/SnapshotBase.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/library/SnapshotStateInternal.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/mock/CMTAT_EXTERNAL_SNAPSHOT_STANDALONE_MOCK.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/mock/CMTAT_STANDALONE_MOCK.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/modules/SnapshotSchedulerModule.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/modules/SnapshotStateModule.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/modules/SnapshotUpdateModule.sol Line: 3

     pragma solidity ^0.8.20;

  • Found in contracts/modules/VersionModule.sol Line: 3

     pragma solidity ^0.8.20;

L-5: Modifier Invoked Only Once

Consider removing the modifier or inlining the logic into the calling function.

1 Found Instances

  • Found in contracts/base/SnapshotEngineBase.sol Line: 18

         modifier onlyBoundToken() {

L-6: Empty Block

Consider removing empty blocks.

3 Found Instances

  • Found in contracts/base/CMTATInternalSnapshotBase.sol Line: 160

         function _authorizeSnapshot() internal virtual override onlyRole(SNAPSHOOTER_ROLE) {

  • Found in contracts/deployment/SnapshotEngine.sol Line: 43

         function _authorizeSnapshot() internal virtual override onlyRole(SNAPSHOOTER_ROLE) {

  • Found in contracts/deployment/SnapshotEngineOwnable2Step.sol Line: 18

         function _authorizeSnapshot() internal virtual override onlyOwner {

L-7: Unchecked Return

Function returns a value but it is ignored. Consider checking the return value.

1 Found Instances

  • Found in contracts/deployment/SnapshotEngine.sol Line: 22

             _grantRole(DEFAULT_ADMIN_ROLE, admin);