Minimalistic EIP-7208 Implementation Security Audit

Audit Report Revisions

Audit Overview

We were tasked with performing an audit of the Nexera codebase and in particular their Minimalistic EIP7208 Implementation.

Over the course of the audit, we observed that the EIP-7208 itself utilizes indeterminate terminology specifically around the interface declarations and the usage of the user-defined DataPoint data type within them.

As the DataPoint is user-defined, the actual function signatures that will be generated based on those interface declarations will utilize the underlying type which can be any based on the implementation.

Feedback in relation to the EIP itself was levied on the relevant Ethereum Magicians Forum thread to encourage collaborative discussion around the recommended changes.

In terms of the EIP-7208 reference implementation that was reviewed as part of this audit, we observed certain inconsistencies that deviate from the system's specification as well as an incorrect masking operation permitting multiple DIID values to point to the same account.

We advise the Nexera team to closely evaluate all minor-and-above findings identified in the report and promptly remediate them as well as consider all optimizational exhibits identified in the report.

Post-Audit Conclusion

The Nexera team iterated through all findings within the report and provided us with a revised commit hash to evaluate all exhibits on.

We evaluated all alleviations performed by Nexera and have identified that a particular exhibit has not been adequately dealt with. We advise the Nexera team to revisit the following exhibit: DPR-01M

Additionally, the following informational finding remains partially addressed and should be revisited: MER-01C

Post-Audit Conclusion (Cont.)

After revisiting the two aforementioned exhibits alongside the Nexera team, we concluded that they had been adequately addressed in the existing commit hash that was provided to us.

Specifically, the DPR-01M finding's solution was found to operate within acceptable gas constraints whilst the MER-01C optimization implemented by the Nexera team was found to be the most gas-efficient one.

As such, we consider all outputs of the audit report properly consumed by the Nexera team with no outstanding actions remaining.

Audit Synopsis

Severity	Identified	Alleviated	Partially Alleviated	Acknowledged
	0	0	0	0
	6	6	0	0
	5	5	0	0
	2	2	0	0
	0	0	0	0

During the audit, we filtered and validated a total of 0 findings utilizing static analysis tools as well as identified a total of 13 findings during the manual review of the codebase. We strongly recommend that any minor severity or higher findings are dealt with promptly prior to the project's launch as they can introduce potential misbehaviours of the system as well as exploits.

Total Alleviations

The list below covers each segment of the audit in depth and links to the respective chapter of the report:

• 🎯 Scope
• 💻 Compilation
• 🔍 Static Analysis
• 👁️ Manual Review
• 🖋️ Code Style