Omniscia Avant Protocol Audit
avUSD System Security Audit
Audit Report Revisions
| Commit Hash | Date | Audit Report Hash |
|---|---|---|
| e41cf3189c | June 27th 2024 | e20d6384a9 |
| 7a667d295d | July 7th 2024 | ec4fdf52b9 |
| 93419dea95 | July 13th 2024 | N/A |
Audit Overview
We were tasked with performing an audit of the Avant Protocol codebase and in particular their avUSD System module.
The system relies on a specialized role to perform mints for the avUSD token, using a set of custodial contracts to store the assets as collateral.
Over the course of the audit, we identified an issue with the nonce-based system which permits invalid nonces to be accepted as well as an issue with the signature delegation system that we believe is too permissive.
We advise the Avant Protocol team to closely evaluate all minor-and-above findings identified in the report and promptly remediate them as well as consider all optimizational exhibits identified in the report.
Post-Audit Conclusion (7a667d295d)
The Avant Protocol team iterated through all findings within the report and provided us with a revised commit hash to evaluate all exhibits on.
We evaluated all alleviations performed by Avant Protocol and have identified that all exhibits have been adequately dealt with.
We have introduced an alleviation chapter for AUM-02M which may prompt a follow-up action by the Avant Protocol team, and have clarified a misconception about exhibit AUM-03M.
Post-Audit Conclusion (93419dea95)
The Avant Protocol team supplied us with a follow-up commit to evaluate further remediations for exhibit AUM-02M.
We consider the exhibit fully alleviated as the conditional has been adjusted per our recommendation, rendering all outputs of the audit report properly consumed by the Avant Protocol team.
Audit Synopsis
| Severity | Identified | Alleviated | Partially Alleviated | Acknowledged |
|---|---|---|---|---|
 | 0 | 0 | 0 | 0 |
 | 22 | 19 | 0 | 3 |
 | 1 | 0 | 0 | 1 |
 | 3 | 2 | 0 | 1 |
 | 0 | 0 | 0 | 0 |
During the audit, we filtered and validated a total of 4 findings utilizing static analysis tools as well as identified a total of 22 findings during the manual review of the codebase. We strongly recommend that any minor severity or higher findings are dealt with promptly prior to the project's launch as they can introduce potential misbehaviours of the system as well as exploits.
Total Alleviations
The list below covers each segment of the audit in depth and links to the respective chapter of the report: