Omniscia AmpleSense Audit
Manual Review
Manual Review
A thorough line-by-line review was conducted on the codebase to identify potential malfunctions and vulnerabilities in the Amplesense EEFI token and surrounding rebase-aware infrastructure.
As the project at hand implements a rebase-aware DeFi integrating tokenomic model, intricate care was put into ensuring that the flow of funds within the system conforms to the specifications and restrictions laid forth within the protocol's specification and that the system performs sanely under any rebase circumstance.
We validated that all state transitions of the system occur within sane criteria and that all rudimentary formulas within the system execute as expected. We pinpointed potential re-entrancy vulnerabilities within the system as well as logical misbehaviours which could have had severe ramifications to its overall operation, however, they were conveyed ahead of time to the Amplesense team to be promptly remediated.
Additionally, the system was investigated for any other commonly present attack vectors such as re-entrancy attacks, mathematical truncations, logical flaws and ERC / EIP standard inconsistencies. The documentation of the project was satisfactory to an adequate extent.
A total of 30 findings were identified over the course of the manual review of which 16 findings concerned the behaviour and security of the system. The non-security related findings, such as optimizations, are included in the separate Code Style chapter.
The finding table below enumerates all these security / behavioural findings:
ID | Severity | Addressed | Title |
---|---|---|---|
AVT-01M | Major | Yes | Incorrect Withdrawal Argument |
AVT-02M | Major | Yes | Inexistent Validation of Deposit Amount |
AVT-03M | Major | Yes | Test Code |
AVT-04M | Medium | Yes | Deprecated Native Asset Transfer |
AVT-05M | Medium | Yes | Dynamic Balance Evaluation |
AVT-06M | Medium | Acknowledged | Inexistent Slippage Arguments |
AVT-07M | Medium | Yes | Potential Denial of Service Attack |
BTR-01M | Major | Yes | Inexistent Approval of Vault |
BTR-02M | Medium | Yes | Deprecated Native Asset Transfer |
BTR-03M | Medium | Yes | Inexistent Slippage Arguments |
BTR-04M | Minor | Yes | Potential for Lock of Ether |
DIS-01M | Medium | Yes | Deprecated Native Asset Transfer |
DIS-02M | Minor | Yes | Inexistent Prohibition of Improper Invocation |
EEF-01M | Minor | Yes | Improper Burn Implementation |
PVT-01M | Minor | Acknowledged | Redundant Execution Path |
SEC-01M | Minor | Yes | Inexistent Validation of Unstake Length |