Omniscia Alliance Block Audit
Compilation
Compilation
The project utilizes etherlime
as its development pipeline tool, containing an array of tests and scripts coded in JavaScript.
To compile the project, the compile
command needs to be issued via the etherlime
CLI tool:
etherlime compile
The etherlime
tool automatically selects Solidity version 0.6.12
based on the compiler specified by the package.json
.
The project contains discrepancies with regards to the Solidity version used as the pragma
statements differ between them. The lower-most requirement was pragma solidity >=0.4.24
, however, version 0.6.12
is locked within the package.json
solc dependency.
We requested the Alliance Block team to lock the pragma
statements to 0.6.12
, the same version utilized for our static analysis as well as optimizational review of the codebase. The Alliance Block team has proceeded to lock all contract pragma
statements accordingly.
During compilation with the etherlime
pipeline, 12 errors were identified 11 of which were related to a mock contract and 1 that has been merged with the findings of the static analysis tools in the respective chapter.
To be able to run our suite of static analysis tools, we ported the codebase to a barebones truffle
installation to produce the proper compilation artifacts as etherlime
appears to be incompatible with the latest version of our toolkits.
3 compilation errors for LiquidityMiningCampaign
, CompoundingRewardsPoolFactory
and NonCompoundingRewardsPoolFacyory
were raised that indicated the contract code size exceeds 24576 bytes, a limit imposed by the Spurious Dragon hard-fork of Ethereum. In most cases, this error can be mitigated by using a low runs
value during the optimization phase. Additionally, a few of the dependencies that the project utilizes in their flattened format contain dead-code that is not utilized and as such could be removed to further reduce the bytecode size.