Omniscia AmpleSense Audit

Manual Review

Manual Review

A thorough line-by-line review was conducted on the codebase to identify potential malfunctions and vulnerabilities in the Amplesense EEFI token and surrounding rebase-aware infrastructure.

As the project at hand implements a rebase-aware DeFi integrating tokenomic model, intricate care was put into ensuring that the flow of funds within the system conforms to the specifications and restrictions laid forth within the protocol's specification and that the system performs sanely under any rebase circumstance.

We validated that all state transitions of the system occur within sane criteria and that all rudimentary formulas within the system execute as expected. We pinpointed potential re-entrancy vulnerabilities within the system as well as logical misbehaviours which could have had severe ramifications to its overall operation, however, they were conveyed ahead of time to the Amplesense team to be promptly remediated.

Additionally, the system was investigated for any other commonly present attack vectors such as re-entrancy attacks, mathematical truncations, logical flaws and ERC / EIP standard inconsistencies. The documentation of the project was satisfactory to an adequate extent.

A total of 30 findings were identified over the course of the manual review of which 16 findings concerned the behaviour and security of the system. The non-security related findings, such as optimizations, are included in the separate Code Style chapter.

The finding table below enumerates all these security / behavioural findings:

IDSeverityAddressedTitle
AVT-01MMajorYesIncorrect Withdrawal Argument
AVT-02MMajorYesInexistent Validation of Deposit Amount
AVT-03MMajorYesTest Code
AVT-04MMediumYesDeprecated Native Asset Transfer
AVT-05MMediumYesDynamic Balance Evaluation
AVT-06MMediumAcknowledgedInexistent Slippage Arguments
AVT-07MMediumYesPotential Denial of Service Attack
BTR-01MMajorYesInexistent Approval of Vault
BTR-02MMediumYesDeprecated Native Asset Transfer
BTR-03MMediumYesInexistent Slippage Arguments
BTR-04MMinorYesPotential for Lock of Ether
DIS-01MMediumYesDeprecated Native Asset Transfer
DIS-02MMinorYesInexistent Prohibition of Improper Invocation
EEF-01MMinorYesImproper Burn Implementation
PVT-01MMinorAcknowledgedRedundant Execution Path
SEC-01MMinorYesInexistent Validation of Unstake Length