DESCRIPTION
The target of this audit is the code repository of Atoshi Chain of Atoshi. Please refer to the report for the detailed audit scope.
Our audit methodology employs automated vulnerability scans, manual verification, and business logic analysis to uncover potential security issues coupled with gas and code quality optimization recommendations.
In summary, we have found that the codebase contains 13 high-risk issues that require prompt attention. In addition, we have identified other non-critical issues as well as recommendations and notes that should be considered. The Atoshi Chain team has addressed these issues promptly. It is important to note that our audit covers only the final reported versions of the codebase. Any subsequent updates would require a re-evaluation.
KEY FINDINGS
In total, we find 21 potential issues in the smart contract. We also have 4 recommendations and 4 notes, as follows:
| ID | Severity | Description | Status |
|---|---|---|---|
| 1 | High | Incorrect implementation of the function EligibleBalance() |
Fixed |
| 2 | High | Permanent loss of energy when the message execution fails | Fixed |
| 3 | High | Incorrect energy accounting after releasing delegations | Fixed |
| 4 | High | Unreachable energy consumption for deployment messages | Fixed |
| 5 | High | Lack of registering the hook function OnBalanceChange() |
Fixed |
| 6 | High | Improper token releases due to the use of stale price data | Fixed |
| 7 | High | Incorrect calculation of freeBalance in the function Delegate() |
Fixed |
| 8 | High | Improper calculation of the available energy in the function Consume() |
Fixed |
| 9 | High | Stale updates of the energy account in the function Delegate() |
Fixed |
| 10 | High | Improper energy consumption in the function attributeDelegatedConsumption() |
Fixed |
| 11 | High | Improper price updating mechanism | Fixed |
| 12 | High | Improper refunding of unused energy | Fixed |
| 13 | High | Violation of the fixed-supply assumption due to the inflation module | Fixed |
| 14 | Medium | Potential fee evasion due to the improper fee calculation in the function computeShortfallFee() |
Fixed |
| 15 | Medium | Ineffective priority due to the use of NoOpMempool |
Fixed |
| 16 | Medium | Incorrect KV prefix usage in the function GetPriceHistory() |
Fixed |
| 17 | Medium | Incorrect priority calculation in the function getTxPriority() |
Fixed |
| 18 | Medium | Lack of validation for gs.PriceHistory in the function InitGenesis() |
Fixed |
| 19 | Medium | Lack of overflow protection in the functions TxEnergyCapacity() and DeployRecoverPerSecond() |
Fixed |
| 20 | Low | Potential inconsistent reward accounting when there are no bonded validators | Fixed |
| 21 | Low | Inconsistent implementation of the function getTxPriority() |
Fixed |
| 22 | - | Complete the validity checks in the function Validate() of the module x/tokenomics |
Fixed |
| 23 | - | Avoid panics in block handlers | Fixed |
| 24 | - | Remove redundant code | Fixed |
| 25 | - | Unify KVStore serialization across all custom modules |
Fixed |
| 26 | - | TotalMinerLocked only increases and never decreases |
- |
| 27 | - | The construction of Merkle proofs for the pre-mine migration | - |
| 28 | - | Ensure proper price reports | - |
| 29 | - | Potential centralization risks | - |
More details are provided in the audit report.
