Security Audit Report for Bitway Labs's Bitway App Chain

The target of this audit is the code repository of Bitway App Chain of Bitway Labs. Note that this repository is rebranded and migrated to a new repository. The Bitway App Chain of the Bitway Lab is a L1 blockchain, facilitating to unlock the value of underutilized Bitcoins. To support full Bitcoin compatibilities, the Bitway App Chain is de- signed to enable transactions to be signed with standard Bitcoin wallets for flexibility. The Bitway App Chain natively integrate lending and farming services, powered by Discreet Log Contracts (i.e., DLC). For the Bitcoin-collateralized lending system of the Bitway App Chain, it enables native Bitcoin-backed loans, integrating decentralized oracles (i.e., Oracle++), per- missionless liquidity pools, and liquidations. Specifically, The Bitway App Chain implements a liquidity pool-based lending protocol that allows Bitcoin holders to borrow while enabling lenders to earn returns. Loan assets are managed on the Bitway App Chain, removing the need for third-party custodians during the loan period. In addition to lending, the Bitway App Chain also provides a farming service that rewards users for staking their coins. By participating in farming, users can lock their assets and earn incentives, distributed on an epoch basis.

Please refer to the report for the detailed audit scope.

Our audit methodology employs automated vulnerability scans, manual verification, and business logic analysis to uncover potential security issues coupled with gas and code quality optimization recommendations.

In summary, we have found that the codebase contains 2 high-risk issues that require prompt attention. In addition, we have identified other non-critical issues as well as security suggestions that should be considered. The Bitway App Chain team has addressed these issues promptly. It is important to note that our audit covers only the final reported versions of the codebase. Any subsequent updates would require a re-evaluation.