Omniscia Evergon Labs Audit
Manual Review
Manual Review
A thorough line-by-line review was conducted on the codebase to identify potential malfunctions and vulnerabilities in Evergon Labs' Tokenizer system.
As the project at hand implements an ODC-integrated tokenizer system that allows fractionalized sales, intricate care was put into ensuring that the flow of funds & assets within the system conforms to the specifications and restrictions laid forth within the protocol's specification.
We validated that all state transitions of the system occur within sane criteria and that all rudimentary formulas within the system execute as expected. We pinpointed multiple significant vulnerabilities within the system which could have had severe ramifications to its overall operation; for more information, kindly consult the relevant major severity exhibits within the audit report as well as the audit report's summary.
Additionally, the system was investigated for any other commonly present attack vectors such as re-entrancy attacks, mathematical truncations, logical flaws and ERC / EIP standard inconsistencies. The documentation of the project was satisfactory to a certain extent, however, we strongly recommend it to be expanded at certain complex points such as which campaign configurations are considered compatible and valid.
A total of 113 findings were identified over the course of the manual review of which 30 findings concerned the behaviour and security of the system. The non-security related findings, such as optimizations, are included in the separate Code Style chapter.
The finding table below enumerates all these security / behavioural findings:
| ID | Severity | Addressed | Title |
|---|---|---|---|
| AUS-01M |  |  | Incorrect State Evaluation |
| CAJ-01M |  | | Inexistent Imposition of Restriction |
| CAT-01M |  | | Potentially Unconfigured Restriction |
| CFN-01M | | | Inexistent Forwarding of Native Funds |
| CFN-02M | | | Inexistent Storage of Data Point |
| EFF-01M | | | Inexistent Handling of Refund |
| EFS-01M | | | Inexplicable Transfer of Data Point Ownership |
| FBF-01M | | | Potentially Unconfigured Restriction |
| FIA-01M | | | Inexistent Accommodation of Obligation Per Fraction Rounding |
| LOS-01M |  | | Inexistent Validation of Non-Zero Minimum |
| LOS-02M | | | Misleading Interference State Index |
| LFU-01M | |  | Inexistent Validation of Caller Authorization |
| MCN-01M | | | Inexistent Integration of NID System |
| OBF-01M | | | Inexistent Validation of Facet Configuration |
| PPS-01M | | | Inexistent Integration of EIP-2771 Caller |
| PPF-01M | | | Inexistent Handling of Downward Rounded Fractions |
| PSN-01M | | | Incompatible Integration of Fractionalized EIP-1155 ODC Implementation |
| PSI-01M | | | Incompatible Integration of Fractionalized EIP-1155 ODC Implementation |
| PTA-01M | | | Potentially Unconfigured Restriction |
| RAS-01M | | | Inexistent Integration of NID System |
| RAG-01M | | | Incorrect State Transition |
| RAG-02M | | | Inexistent Validation of Caller Authorization |
| RSI-01M | | | Inexistent Integration of NID System |
| RFS-01M | | | Inexistent Handling of Refund |
| TFL-01M | | | Inexistent Release of Bought NFT |
| TFO-01M | | | Incorrect State Transition |
| TFO-02M | | | Inexistent Release of Bought NFT |
| UPV-01M | | | Inexistent Access Control Restriction |
| UPF-01M | | | Potential Cascading Rounding Errors |
| UPF-02M | | | Incompatible Fraction EIP-1155 ODC Integration |