Omniscia fetchai Audit

Atomix Protocol Security Audit

We were tasked with performing a second round audit on the Atomix Lending Protocol by fetch.ai which refactored the functionality of the contracts to be relocated to dedicated contracts as well as revised the debt flow system between the loan liquidator and lending pool to more seamlessly "rebalance" the debt of each component within the system.

We were able to identify multiple inefficiencies in the codebase as well as certain major issues that relate to inexistent access control and unsafe arithmetics which we strongly urge the fetch.ai team to deal with as soon as possible.

Overall, the codebase has been refactored to a great extent and made much more legible, however, we believe there to still be room for improvement especially with regards to the naming conventions utilized across the codebase as well as general structure of the code as most of the static analysis findings we filtered were relating to the uncommon naming conventions used by the Atomix system.

Files in ScopeRepositoryCommit(s)
ACT.sol (ACT)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
AtomixBase.sol (ABE)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
AtomixWallet.sol (AWT)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
ALPTotalDebts.sol (ALP)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
AccessManager.sol (AMR)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
AccessControlLite.sol (ACL)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
AtomixPausableBase.sol (APB)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
BreachMonitor.sol (BMR)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
CashAsset.sol (CAT)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
ContractRegistry.sol (CRY)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
DebtCashIn.sol (DCI)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
DebtBalancer.sol (DBR)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
IAsset.sol (IAT)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
ITokenizer.sol (ITR)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
IAtomixWallet.sol (IAW)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
InterestManager.sol (IMR)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
IInterestManager.sol (IIM)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
IContractRegistry.sol (ICR)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
IUtilizationRatio.sol (IUR)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
ILoanStatusMonitor.sol (ILS)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
InterestCalculator.sol (ICO)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
IContractRegistryListener.sol (ICL)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
LendingPool.sol (LPL)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
LoanLiquidator.sol (LLR)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
LendingPoolStorage.sol (LPS)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
LoanLiquidatorStorage.sol (LLS)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
LendingPoolStorageModifier.sol (LPM)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
PoolStorageBase.sol (PSB)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
RateModelLL.sol (RML)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
RateModelLP.sol (RMP)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
RateModelLL2.sol (RLL)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
RateModelLP2.sol (RLP)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
SecuredAsset.sol (SAT)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
StableCoinToken.sol (SCT)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
Tokenizer.sol (TOK)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
TokenValueStorage.sol (TVS)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
UniqueId.sol (UID)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b
XSC.sol (XSC)atomix_contractsefa056dae0,
96ef81284e,
b3f269f28b

During the audit, we filtered and validated a total of 8 findings utilizing static analysis tools as well as identified a total of 24 findings during the manual review of the codebase. We strongly recommend that any minor severity or higher findings are dealt with promptly prior to the project's launch as they introduce potential misbehaviours of the system as well as exploits.

The list below covers each segment of the audit in depth and links to the respective chapter of the report: