MANTRA Chain audit details

• Total Prize Pool: $60,000 in USDC
  • HM awards: $47,800 in USDC
  • QA awards: $2,000 in USDC
  • Judge awards: $5,800 in USDC
  • Validator awards: $3,900 in USDC
  • Scout awards: $500 in USDC
• Read our guidelines for more details
• Starts November 29, 2024 20:00 UTC
• Ends January 6, 2025 20:00 UTC

Note re: risk level upgrades/downgrades

Two important notes about judging phase risk adjustments:

• High- or Medium-risk submissions downgraded to Low-risk (QA)) will be ineligible for awards.
• Upgrading a Low-risk finding from a QA report to a Medium- or High-risk finding is not supported.

As such, wardens are encouraged to select the appropriate risk level carefully during the submission phase.

Publicly Known Issues

Note for C4 wardens: Anything included in this Publicly Known Issues section is considered a publicly known issue and is ineligible for awards.

Issues directly related to cosmos-sdk, IBC, cosmwasm and their dependencies (comet-bft) will not be within the scope of this audit. Basically if it is a issue affecting all cosmos chains of the same versions then it should be out of scope.

However, if the issue arise from the custom code we made on our cosmos-sdk, or if the issues are directly affecting behavior of our custom modules, or if our custom modules are causing issues in the base cosmos modules (includes cosmwasm and IBC) then they should be included in the scope.

Overview

Mantrachain is a global real-world assets platform built on blockchain technology. It leverages advanced blockchain features to facilitate the tokenization and trading of real-world assets.

Features:

• Real-world asset tokenization
• Advanced blockchain technology integration
• Multi-token support for transaction fees
• Custom fee market implementation
• Cosmos SDK-based architecture

Links

• Previous audits: Ottersec (report isn't public)
• Documentation: https://github.com/MANTRA-Chain/mantrachain/tree/v1.0.2
• Website: https://www.mantrachain.io/
• X: https://twitter.com/MANTRA_Chain

---

Scope

See scope.txt

Scoping Q & A

General questions

External integrations (e.g., Uniswap) behavior in scope:

EIP compliance checklist

N/A

Additional context

Main invariants

Tokenfactory

• The user that created a token is the token admin of that token
• Only token admin can force transfer and mint tokens

Attack ideas (where to focus for bugs)

We have a custom tokenfactory module. We are concerned to see if this module can be exploited to have unintended behavior such as:

• minting by users not the token admin
• force transfer of tokens not done by token admin

All trusted roles in the protocol

Mostly permissionless.

Some functionalities are only invoked by governance through proposals and voting.

Describe any novel or unique curve logic or mathematical models implemented in the contracts:

N/A

Running tests

git clone --recurse https://github.com/code-423n4/2024-11-mantra.git 
cd 2024-11-mantra
go mod tidy
make install
make test

Miscellaneous

Employees of MANTRA and employees' family members are ineligible to participate in this audit.

Code4rena's rules cannot be overridden by the contents of this README. In case of doubt, please check with C4 staff.