Moxie Zenith
Findings & Analysis Report

2024-09-24

Table of contents

Overview

About C4

Code4rena (C4) is an open organization consisting of security researchers, auditors, developers, and individuals with domain expertise in smart contracts.

A C4 Pro League Audit is an event where elite tier Code4rena contributors, commonly referred to as wardens, reviews, audits and analyzes smart contract logic in exchange for a bounty provided by sponsoring projects.

During the Pro League audit outlined in this document, C4 conducted an analysis of the Moxie smart contract system written in Solidity. The audit took place between Sept 23 - Sept 24, 2024.

Wardens

1 Warden contributed to Moxie:

  1. hickuphh3

Final report assembled by bytes032 and Sentinel

Summary

The C4 Pro League analysis yielded no HIGH or MEDIUM severity vulnerabilities.

Additionally, C4 Pro League analysis included 4 findings with an INFORMATIONAL risk rating.

Scope

The source code was delivered to Code4rena in a private Git repository.

Severity Criteria

C4 assesses the severity of disclosed vulnerabilities based on three primary risk categories: high, medium, and low/non-critical.

High-level considerations for vulnerabilities span the following key areas when conducting assessments:

  • Malicious Input Handling
  • Escalation of privileges
  • Arithmetic
  • Gas use

For more information regarding the severity criteria referenced throughout the submission review process, please refer to the documentation provided on the C4 website, specifically our section on Severity Categorization.

Informational Findings (4)

Share buyer isn’t correctly logged for buyAndLockFor() and buyAndLockMultipleFor()

Context

Description

When buying shares and locking for a beneficiary, the buyer is msg.sender and the recipient is the beneficiary. The Lock event records when the lock was a purchase from the _isBuy parameter, but the _user recorded will be the beneficiary when the purchase was initiated by the caller.

Recommendation

Consider changing isBuy to buyer that logs msg.sender if the lock was created after a buy, address(0) if it isn’t.

Moxie

Fixed with the following commit.

C4 Zenith

Fix reviewed.

Redundancies

Context

Description

  • The errors Staking_InvalidIndex and Staking_AlreadyWithdrawn are defined but unused.
  • OwnableUpgradeable is imported but unused.
  • The non-reentrant modifier was removed for all external functions, but the inherited ReentrancyGuard wasn’t.

Recommendation

Remove the redundancies.

Moxie

Fixed in 27fc92603b294e4641cbb23d737bd6da64700646 & bd966bfaa0606347b619e548b85467b3dff29912.

C4 Zenith

Fix reviewed

Add tests for duplicate indexes

Context

Description

Duplicate indexes are not explictly checked in _extractExpiredAndDeleteLocks, but the function will revert in this scenario with Staking_SubjectsDoesNotMatch because the lock is deleted after it’s iterated upon.

This is also the case for the getter getTotalStakedAmount(), but is less of a concern because it is not state-changing.

Recommendation

Add tests for duplicate indexes to ensure that any implementation changes will catch this behaviour.

Moxie

Fixed in the following commit.

C4 Zenith

Fix reviewed

unlockTimeInSec_ calculation can be abstracted

Context

Description

unlockTimeInSec_ is calculated multiple times for multiple deposits and buys for the same _lockPeriodInSec.

Recommendation

Consider abstracting the calculation to an internal function so it needs to be performed only once.

Moxie

Fixed in fdc31342c088bba72a28498584493d8a3c560f11, d048c5cb6814eb9dca2c55bf475bb8d60a22b60f & 6b1639ef8fd0f6c057f3cd89461b898080939df3.

C4 Zenith

Fix reviewed

Disclosures

C4 is an open organization governed by participants in the community.

C4 audits incentivize the discovery of exploits, vulnerabilities, and bugs in smart contracts. Security researchers are rewarded at an increasing rate for finding higher-risk issues. Audit submissions are judged by a knowledgeable security researcher and solidity developer and disclosed to sponsoring developers. C4 does not conduct formal verification regarding the provided code but instead provides final verification.

C4 does not provide any guarantee or warranty regarding the security of this project. All smart contract software should be used at the sole risk and responsibility of users.