Nibiru audit details

• Total Prize Pool: $70,000 in USDC
  • HM awards: $55,800 in USDC
  • QA awards: $2,300 in USDC
  • Judge awards: $6,800 in USDC
  • Validator awards: $4,600 USDC
  • Scout awards: $500 in USDC
• Read our guidelines for more details
• Starts November 11, 2024 20:00 UTC
• Ends November 25, 2024 20:00 UTC

Automated Findings / Publicly Known Issues

Note for C4 wardens: Anything included in this Automated Findings / Publicly Known Issues section is considered a publicly known issue and is ineligible for awards.

• https://github.com/NibiruChain/nibiru/issues/2075 - [evm] Oracle precompile UX would be improved by update time information S-triage

• https://github.com/NibiruChain/nibiru/issues/2063 - A known issue we're in the progress of implementing a solution for. This doesn't present a security issue because transaction messages that use an invalid ERC20 in their FunToken mapping will simply fail to be executed.

Overview

Nibiru Chain is a breakthrough Layer 1 blockchain and smart contract ecosystem providing superior throughput, improved security, and a high-performance EVM execution layer. Nibiru aims to be the most developer-friendly and user-friendly smart contract ecosystem, leading the charge toward mainstream Web3 adoption by innovating at each layer of the stack: dApp development, scalable blockchain data indexing, consensus optimizations, a comprehensive developer toolkit, and composability across multiple VMs.

Links

• Previous audits: We did a C4 Zenith audit right before this competitive audit, though it doesn't have a report I can link yet. A much earlier version of the chain was also audited by Zellic prior to Nibiru's inclusion of the EVM (https://reports.zellic.io/publications/nibiru).
• Documentation:
  • Docs | Nibiru Chain: Conceptual and technical documentation can be found here.
  • Complete Golang reference docs: (pkg.go.dev) For the blockchain implementation .
  • Nibiru Modules: Module-specific documentation
• Website: https://nibiru.fi/
• X/Twitter: https://twitter.com/NibiruChain
• Discord: https://discord.com/invite/HFvbn7Wtud

---

Scope

See scope.txt

Files in scope

*Ignore .pb.go protobuf files

Files out of scope

See the files in out_of_scope.txt

Scoping Q & A

General questions

ERC20 token behaviors in scope

External integrations (e.g., Uniswap) behavior in scope

EIP compliance checklist

Additional context

Main invariants

1. NIBI is "ether" on the network, and microNIBI (written "unibi") is the smallest unit of NIBI. The following invariant holds true: 1 NIBI == 10^{18} wei == 10^{6} unibi. Note that this implies we cannot transfer values smaller than 10^{12} wei.

2. All of the standard invariants of the EVM StateDB should work exactly as they do on Ethereum mainnet.

3. Account state is not held by a particular VM, since an address is actually just a byte array. Thus, all accounts have both a nibi-prefixed Bech32 address and Ethereum hexadecimal address, each derived from the same bytes.

4. Any bank coin on Nibiru can be used to create a canonical ERC20 representation, for which the EVM itself (the module account) will be the owner.

5. Similar to (3), any ERC20 on Nibiru can be used to create a canonical bank coin representation. The owner of the ERC20 is unbounded, while only the EVM Module account can mint the bank coin representation produced.

Attack ideas (where to focus for bugs)

• When users of Nibiru interact over external clients like ethers.js and wagmi, is the behavior familiar like what developers would expect on the Ethereum L1 or networks like BSC, Base, or Arbitrum?
• Does the Ethereum JSON-RPC interface for Nibiru operate as expected in terms of transaction receipts, contract deployment and interactions, and how error messages are displayed?

All trusted roles in the protocol

Nibiru EVM has a few cases of special permissions: the EVM Module, the proof of stake governance authority, and the owner of an ERC20 as it pertains to the FunToken mapping mechanism:

Describe any novel or unique curve logic or mathematical models implemented in the contracts

N/A

Running tests

To run the local network, please install the Nibiru CLI:

git clone --recurse https://github.com/code-423n4/2024-11-nibiru.git
cd 2024-11-nibiru

cargo install just
just # see all commands

just install
just build
just localnet # Run a local network

cd evm-e2e
cp .env_sample .env
just install
just test # Runs the EVM end to end tests suite with ethers.js

Miscellaneous

Employees of Nibiru and employees' family members are ineligible to participate in this audit.

Code4rena's rules cannot be overridden by the contents of this README. In case of doubt, please check with C4 staff.