Butterfly Token V2 Security Audit

Audit Overview

We were tasked with performing an audit of the Redacted Cartel codebase and in particular their new BTRFLY V2 implementation along with the surrounding migration infrastructure.

Over the course of the audit, we identified a potential misbehaviour within the Mariposa contract as well as several minor issues around standard conformity and potential deviances from the original BTRFLY V1 implementation.

We advise the Redacted Cartel team to closely evaluate all minor-and-above findings identified in the report and promptly remediate them as well as consider all optimizational exhibits identified in the report.

Post-Audit Conclusion

The Redacted Cartel team produced a response document as well as detailed commits for each of the exhibits outlined as well as produced test suites meant to nullify one of the exhibits outlined in the report.

We advise the TMR-01M, MAR-01M, MAR-03C, and MAR-04C exhibits to be re-visited for further potential adjustments to the code prior to finalization.

Contracts Assessed

Audit Synopsis

Severity	Identified	Alleviated	Partially Alleviated	Acknowledged
	2	2	0	0
	6	3	1	2
	2	2	0	0
	2	1	0	1
	0	0	0	0

During the audit, we filtered and validated a total of 2 findings utilizing static analysis tools as well as identified a total of 10 findings during the manual review of the codebase. We strongly recommend that any minor severity or higher findings are dealt with promptly prior to the project's launch as they introduce potential misbehaviours of the system as well as exploits.

The list below covers each segment of the audit in depth and links to the respective chapter of the report:

• 💻 Compilation
• 🔍 Static Analysis
• 👁️ Manual Review
• 🖋️ Code Style