Omniscia AllianceBlock Audit
Manual Review
Manual Review
A thorough line-by-line review was conducted on the codebase to identify potential malfunctions and vulnerabilities in AllianceBlock's cross-chain messaging protocol.
As the project at hand implements a cross-chain messaging protocol leveraging the Teleport system of AllianceBlock as well as Chainlink's CCIP system, intricate care was put into ensuring that the flow of funds within the system conforms to the specifications and restrictions laid forth within the protocol's specification.
We validated that all state transitions of the system occur within sane criteria and that all rudimentary formulas within the system execute as expected. We pinpointed a flaw in the governance mechanism's maintenance process which could have had severe ramifications to its overall operation; we urge the AllianceBlock team to promptly evaluate it and all other medium-severity exhibits and alleviate them.
Additionally, the system was investigated for any other commonly present attack vectors such as re-entrancy attacks, mathematical truncations, logical flaws and ERC / EIP standard inconsistencies. The documentation of the project was satisfactory to a certain extent, however, we strongly recommend it to be expanded at certain complex points such as the AllianceBlock Teleport integrations.
In relation to the Diamond EIP-2535 contracts present in the codebase (LibDiamond, DiamondLoupeFacet, and Diamond), they were validated based on the implementation of the EIP's author Nick Mudge on the following repository. While some functional discrepancies were observed due to the usage of a different pragma version (^0.7.1 of original versus ^0.8.9 of AllianceBlock), we do not consider these discrepancies harmful as the overflows that may occur from them should be properly prevented.
A total of 41 findings were identified over the course of the manual review of which 17 findings concerned the behaviour and security of the system. The non-security related findings, such as optimizations, are included in the separate Code Style chapter.
The finding table below enumerates all these security / behavioural findings:
| ID | Severity | Addressed | Title |
|---|---|---|---|
| CCI-01M |  |  | Potentially Outdated Chainlink CCIP Version |
| CCI-02M |  | | Inexistent Uniqueness Validation |
| CCI-03M |  | | Incorrect Fee Validation |
| DDN-01M | | | Inexplicable Presence of Native Fund Receipt |
| FCF-01M |  | | Inexistent Direct Invocation Protection |
| GEL-01M | | | Inefficient Validation of Uniqueness |
| GFT-01M | | | Inexistent Direct Invocation Protection |
| GFT-02M | | | Inexistent Conformity of Checks-Effects-Interactions Pattern |
| GFT-03M |  | | Improper Mandation of Fund Distribution |
| LTT-01M | | | Inexistent Guarantee of Uniqueness |
| MPP-01M | | | Inexistent Direct Invocation Protection |
| MWD-01M | | | Incorrect Assignment |
| M2L-01M | | | Discrepant Documentation of Code |
| TFT-01M | | | Inexistent Direct Invocation Protection |
| TFT-02M | | | Contradictory Fee System |
| UFT-01M | | | Inexistent Validation of Contract Existence |
| UFT-02M | | | Inexistent Direct Invocation Protection |