Smart Contract Audit

Ukraine's Angels
March 14, 2022

Summary

Vidma team has conducted a smart contract audit for the given codebase.

The contracts are in good condition. Based on the fixes provided by the Ammbr team and on the quality and security of the codebase provided, Vidma team can give a score of 95 to the audited smart contracts.

During the auditing process, the Vidma team has found a couple of informational issues, 7 issues with a low level of severity, 1 issue with a medium level of severity, and 3 issues with a critical level of severity.

Severity of the issue
Total found
Resolved
Unresolved
Critical
3 issues
3 issues
0 issues
High
3 issues
3 issues
0 issues
Medium
3 issues
3 issues
0 issues
Low
3 issues
3 issues
0 issues
Informational
3 issues
3 issues
0 issues
Low
3 issues
3 issues
0 issues

The contracts are in good condition. Based on the fixes provided by the Ammbr team and on the quality and security of the codebase provided, Vidma team can give a score of 95 to the audited smart contracts.

Based on the given findings, risk level, performance, and code style, Vidma team can grant the following overall score:

Please mind that this audit does not certify the definite reliability and security level of the contract. This document describes all vulnerabilities, typos, performance issues, and security issues found by Vidma auditing team. If the code is under development, we recommend run one more audit once the code is finalized.

Summary

Vidma team has conducted a smart contract audit for the given codebase.

Need to be mentioned, that there is no hardcoded address in the contract so we can not predict to which address the funds will be sent. Speaking about the official governmental addresses, they don’t have one that accepts BNB.

After a chat with the Ukraine’s Angels team, they elaborated that they work with different charity organizations and also make independent purchases for the army and people in need. They also assure that all reports on the spent funds are shown in their channel.

A detailed summary of the issues and their current state is displayed in the table below.

Severity of the issue Issue severity
Critical
High
Medium
Low
Informational
Total
Severity of the issue Issue severity Total found Resolved Unresolved
Critical 0 issues 0 issues 0 issues
High 0 issues 0 issues 0 issues
Medium 0 issues 0 issues 0 issues
Low 3 issues 0 issues 3 issues
Informational 3 issues 0 issues 3 issues
Total 6 issues 0 issues 6 issues

Evaluating the findings, we can assure that the contract is safe to use and all the issues found are performed only by certain conditions and cases. Under the given circumstances we can set the following risk level:

High Confidence

Vidma auditors are evaluating the initial commit given for the scope of the audit and the last commit with the fixes. Hence, it helps to adequately evaluate the development quality. Code style, optimization of the contracts, amount, and risk level of the issues are taken into consideration. The Vidma team has developed the transparent scoring system presented below.

Severity of the issue
Issue severity
Total found
Resolved
Critical
1
10
High
0.8
7
Medium
0.5
5
Low
0.2
0.5
Informational
0
0.1

Based on the given findings, risk level, performance, and code style, Vidma team can grant the following overall score:

98.20

Vidma auditing team has conducted a bunch of integrated autotests to ensure that the given codebase has decent performance and security levels. The test results and the coverage can be found in the accompanying section of this audit report.

Please mind that this audit does not certify the definite reliability and security level of the contract. This document describes all vulnerabilities, typos, performance issues, and security issues found by Vidma auditing team. If the code is under development, we recommend run one more audit once the code is finalized.

Scope of work

Ukraine's Angels is here to help Ukrainian people to fight off the plague of war afflicting their communities right now. This is the world’s crypto family’s contribution to #StopTheWar.

Within the scope of this audit, two independent auditors deeply investigated the given codebase and analyzed the overall security and performance of smart contracts.

The debrief took place from March 9th to 11th, 2022 and the final results are present in this document.

Vidma auditing team has made a review of the following contract:

  • UkrAngelsNFT

Initial commit submitted for the audit :
https://bscscan.com/address/0x1cee20367ebda61500dd037a0ba2a9a2b733d391#code

Workflow of the auditing process

During the manual phase of the audit, Vidma team manually looks through the code in order to find any security issues, typos, or discrepancies with the logic of the contract.

Within the testing part, Vidma auditors run integration tests using the Truffle testing framework. The test coverage and the tests themselves are inserted into this audit report.

Vidma team uses the most sophisticated and contemporary methods and techniques to ensure the contract does not have any vulnerabilities or security risks:

Re-entrancy;
Access Management Hierarchy;
Arithmetic Over/Under Flows;
Unexpected Ether;
Delegatecall;
Default Public Visibility;
Hidden Malicious Code;
Entropy Illusion (Lack of Randomness);
External Contract Referencing;
Short Address/Parameter Attack;
Unchecked CALL Return Values;
Race Conditions / Front Running;
General Denial Of Service (DOS);
Uninitialized Storage Pointers;
Floating Points and Precision;
Tx.Origin Authentication;
Re-entrancy;
Signatures Replay;
Pool Asset Security (backdoors in the underlying ERC-20).

Structure and organization of the findings

For the convenience of reviewing the findings in this report, Vidma auditors classified them in accordance with the severity of the issues. (from most critical to least critical). The acceptance criteria are described below.

All issues are marked as "Resolved" or "Unresolved", depending on whether they have been fixed by Ukraine’s Angels or not. The latest commit, indicated in this audit report should include all the fixes made.

To ease the explanation, the Vidma team has provided a detailed description of the issues and recommendations on how to fix them.

Hence, according to the statements above, we classified all the findings in the following way:

Finding
Description
Critical
The issue bear a definite risk to the contract, so it may affect the ability to compile or operate.
High
Major security or operational risk found, that may harm the end-user or the overall performance of the contract.
Medium
The issue affects the contract to operate in a way that doesn’t significantly hinder its performance.
Low
Major security or operational risk found, that may harm the end-user or the overall performance of the contract.
Informational
The issue bear a definite risk to the contract, so it may affect the ability to compile or operate.

Manual Report

Pragma is not locked to a specific version

Low |  Unresolved

Since not all the EVM compiler versions support all the features, especially the latest ones which are kind of beta versions, the intended behavior written in code might not be executed as expected. Locking the pragma helps ensure that contracts do not accidentally get deployed using, for example, the latest compiler which may have higher risks of undiscovered bugs.

Recommendation:

Replace pragma solidity ^0.8.0 with pragma solidity 0.8.12.

Additional verification of address and amount is required

Low  |  Unresolved

In the function donate() there is no verification for the zero address of the receiver and zero value of amount.

Recommendation

Add an additional check for address and amount.

Additional verification of token’s balance and the amount is required

Low  |  Unresolved

In the function retrieveTokens() there is no verification whether there will be funds in the balance account to send and the value of the amount.

Recommendation:

Add an additional check for the amount and token’s balance.

Example:

require(amount > 0 && amount 
<=IERC20(tokenContractAddress).balanceOf(address(this)),   ‘Amount invalid’);

Lack of NatSpec annotations

Informational  |  Unresolved

Smart contract UkrAngelsNFT.sol is not covered by NatSpec annotations.

Recommendation:

Consider to cover by NatSpec all contract’s methods.

Functions order at UkrAngelsNFT.sol contract

Informational  |  Unresolved

The functions in contract UkrAngelsNFT.sol are not grouped according to their visibility and order.

Functions should be grouped according to their visibility and ordered in the following way:

  • Constructor;
  • Receive function (if exists);
  • Fallback function (if exists);
  • External;
  • Public;
  • Internal;
  • Private.

Recommendation:

Consider changing functions order according to solidity documentation: Order of Functions.

Order of layout

Informational  |  Unresolved

The layout contract elements in the UkrAngelsNFT contract are not logically grouped.

The contract elements should be grouped and ordered in the following way:

  • Pragma statements;
  • Import statements;
  • Interfaces;
  • Libraries;
  • Contract.

Inside each contract, library or interface, use the following order:

  • Library declarations (using statements);
  • Constant variables;
  • Type declarations;
  • State variables;
  • Events;
  • Modifiers;
  • Functions.

Ordering helps readers to navigate the code and find the elements more quickly.

Recommendation:

Consider changing layout order according to solidity style guide documentation.

Test Results

To verify the contract security and performance a bunch of integration tests was made using the Truffle testing framework.

Tests were based on the functionality of the code, business logic, and requirements and for the purpose of finding the vulnerabilities in the contacts.

In this section, we provide tests written by Vidma auditors.

Vidma Coverage – 100%

Industry Standard – 95%


It's important to note that Vidma auditors do not modify, edit or add tests to the existing tests provided in the Ukraine's Angels repo. We write totally separate tests with code coverage of a minimum of 95%, to meet the industry standards.


Tests are written by Vidma

Test Coverage

File
contracts\
UkrAngelsNFT.sol
All Files
File % Stmts % Branch % Funcs % Lines
contracts\ 100.00 100.00 100.00 100.00
UkrAngelsNFT.sol 100.00 100.00 100.00 100.00
All Files 100.00 100.00 100.00 100.00


Test Results

Contract:UkrAngelsNFT

  • UkrAngelsNFT Test Cases
  • UkrAngelsNFT Deploy Test Cases
    • should deploy with correct name(636ms)
    • should deploy with correct symbol(165ms)
    • should deploy with correct max supply(133ms)
    • should deploy with correct initial token price(144ms)
    • should deploy with correct owner(157ms)
  • UkrAngelsNFT Owner Test Cases
    • should change token price correctly(667ms)
    • should set base URI correctly(422ms)
    • should donate correctly(799ms)
    • should retrieve tokens correctly(960ms)
    • shouldn't change token price by not the owner(563ms)
    • shouldn't set base URI by not the owner(277ms)
    • shouldn't donate by not the owner(345ms)
    • shouldn't retrieve tokens by not the owner(377ms)
  • UkrAngelsNFT User Interaction Test Cases
    • should buy token correctly(904ms)
    • should buy more than one token correctly(178717ms)
    • shouldn't buy tokens with zero amount or amount greater than 10(691ms)
    • shouldn't buy tokens with invalid buy price(855ms)
    • shouldn't buy tokens more than max supply(1033ms)
18 passing (3m)

We are delighted to have a chance to work together with Ukraine's Angels team and contribute to their success by reviewing and certifying the security of the smart contracts.

The statements made in this document should not be interpreted as investment or legal advice, nor should its authors be held accountable for decisions made based on them.