Version 2.3 Security Audit

Audit Report Revisions

Audit Overview

We were tasked with performing an audit of the Boson Protocol codebase and in particular the changes introduced between version 2.2.0 and 2.3.0, including the interim 2.2.1 version released.

Over the course of the audit, we identified multiple potential vulnerabilities of significant severity that arise from the introduction of new features without proper consideration of side-effects that they introduce in the old system.

Namely, the major vulnerabilities we identified:

• Cause incorrect consumption of seller handler updates as a result of the new collection-level BosonVoucher instances
• Result in improper validation of group conditions as a result of the new per-token-ID commit system
• Compromise assets held by the BosonVoucher contract as a result of the arbitrary-call capability introduced to it that is insufficiently protected
• Corrupt the storage space of upgraded BosonVoucher instances due to the removal of variables instead of their deprecation

Additionally, we evaluated the security of the full changelog between the 2.2.0 and 2.3.0 versions, including ensuring that the removal of protocol-wide limitations is secure, asserting that the new condition style is properly assimilated in the codebase, assessing the impact of create2-based deployment mechanisms for BosonVoucher instances, and more.

As a result of our evaluation, we were able to pinpoint vulnerabilities that concern these new features as well as potential ways the protocol can enhance itself further in terms of functionality as well as backwards-compatibility, a trait we identified is not present in certain sensitive functions of the protocol.

Given that this is a delta audit, certain findings that have been included in older audit rounds have not been replicated in this audit report for the sake of brevity; all findings included concern newly introduced code as well as affected code of newly introduced functionality.

We advise the Boson Protocol team to closely evaluate all minor-and-above findings identified in the report and promptly remediate them as well as consider all optimizational exhibits identified in the report.

Post-Audit Conclusion

The Boson Protocol team iterated through all findings within the report and provided us with a revised commit hash to evaluate all exhibits on.

We evaluated all alleviations performed by Boson Protocol and have identified that certain exhibits have not been adequately dealt with. Specifically, some were partially alleviated while others have had additional information introduced to them and we advise them to be re-visited: SBE-02M, EHF-01M, EHF-02C, BVR-05M, BVR-04M

Post-Audit Conclusion (584e7d054c)

The Boson Protocol assessed the remaining exhibits highlighted above and proceeded to correctly apply the remediation of exhibit EHF-02C while providing supplemental information in the threads of the rest.

We revisited these exhibits and re-evaluated them based on this information, either marking them acknowledged, nullified, or properly alleviated.

No outstanding exhibits remain in the report and all outputs of the audit have been properly consumed by the Boson Protocol team.

Contracts Assessed

Audit Synopsis

Severity	Identified	Alleviated	Partially Alleviated	Acknowledged
	3	3	0	0
	14	12	0	2
	6	5	0	1
	5	4	0	1
	4	4	0	0

During the audit, we filtered and validated a total of 2 findings utilizing static analysis tools as well as identified a total of 30 findings during the manual review of the codebase. We strongly recommend that any minor severity or higher findings are dealt with promptly prior to the project's launch as they can introduce potential misbehaviours of the system as well as exploits.

The list below covers each segment of the audit in depth and links to the respective chapter of the report:

• 💻 Compilation
• 🔍 Static Analysis
• 👁️ Manual Review
• 🖋️ Code Style