{"id":192,"date":"2021-11-09T12:00:44","date_gmt":"2021-11-09T10:00:44","guid":{"rendered":"https:\/\/ackeeblockchain.com\/blog\/?p=192"},"modified":"2022-08-13T15:06:04","modified_gmt":"2022-08-13T13:06:04","slug":"ackee-blockchain-audited-goodghosting","status":"publish","type":"post","link":"https:\/\/ackee.xyz\/blog\/ackee-blockchain-audited-goodghosting\/","title":{"rendered":"Ackee Blockchain audited GoodGhosting"},"content":{"rendered":"<h4>About GoodGhosting<\/h4>\n<p><span style=\"font-weight: 400;\"><a href=\"https:\/\/goodghosting.com\/\">GoodGhosting<\/a> is <strong>a DeFi no-loss saving <a href=\"https:\/\/ackeeblockchain.com\/blog\/glossary\/protocol\/\">protocol<\/a><\/strong> that collects deposits from users and earns yield on those deposits through decentralized finance dapps like AAVE and Curve.<\/span><!--more--><\/p>\n<h5>How does GoodGhosting work?<\/h5>\n<p><span style=\"font-weight: 400;\">At the time of writing this blog post, GoodGhosting supports Polygon and Celo. GoodGhosting&#8217;s no-loss saving game is played by <strong>depositing funds into a saving pool by players<\/strong> of the saving game. Players have to keep depositing their funds to a saving pool as specified in each game&#8217;s rules to earn interest and rewards. If they miss a deposit deadline, they will not earn any interest but get their initial deposit back. <strong>Winners earn a slice of the pool&#8217;s rewards<\/strong> by not missing any deadline for deposits when the saving game is over.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Interest is earned through decentralized finance dapps like Aave, Curve on Polygon, or Moola on Celo.<\/span><\/p>\n<p class=\"p1\">To learn more about GoodGhosting, read <strong>the official documentation <\/strong><a href=\"https:\/\/docs.goodghosting.com\/docs\/\"><span class=\"s1\"><strong>here<\/strong><\/span><\/a>.<\/p>\n<h4>About the audit<\/h4>\n<p><span style=\"font-weight: 400;\"><strong>On October 8, 2021<\/strong>, the<\/span> <a href=\"https:\/\/ackeeblockchain.com\/\"><span style=\"font-weight: 400;\">Ackee Blockchain<\/span><\/a><span style=\"font-weight: 400;\"> security team completed an <a href=\"https:\/\/ackeeblockchain.com\/blog\/glossary\/audit\/\">audit<\/a> of the GoodGhosting protocol. The whole auditing process was performed with a total time donation of <strong>6 engineering days<\/strong>.<\/span><\/p>\n<p class=\"p1\">At the beginning of the\u00a0audit, the\u00a0following\u00a0<b>main objectives\u00a0<\/b>were defined:<\/p>\n<ul>\n<li class=\"p2\">Check the code quality, architecture and best practices.<\/li>\n<li class=\"p2\">Check if nobody unauthorized is able to steal funds.<\/li>\n<li class=\"p2\">Check if redeem calculations are consistent and don&#8217;t contain any mismatches.<span class=\"Apple-converted-space\">\u00a0<\/span><\/li>\n<li class=\"p2\">Check if nobody is allowed to cheat the game or manipulate the logic.<\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">The audit methodology for GoodGhosting consisted of:<\/span><\/p>\n<ol>\n<li><span style=\"font-weight: 400;\"><strong>Technical specification\/documentation<\/strong> &#8211; a brief overview of the system is requested from the client and the scope of the audit is defined.<\/span><\/li>\n<li><strong>Tool-based analysis<\/strong> &#8211; deep check with automated <a href=\"https:\/\/ackeeblockchain.com\/blog\/glossary\/solidity\/\">Solidity<\/a> analysis tools MythX and <a href=\"https:\/\/ackeeblockchain.com\/blog\/glossary\/slither\/\">Slither<\/a> is performed.<\/li>\n<li><strong>Manual code review<\/strong> &#8211; the code is checked line by line for common vulnerabilities, code duplication, best practices and the code architecture is reviewed.<\/li>\n<li><strong>Local deployment + hacking<\/strong> &#8211; the contracts are deployed locally and we try to attack the system and break it.<\/li>\n<li><strong>Unit testing and fuzzy testing<\/strong> &#8211; run unit tests to ensure that the system works as expected, potentially write missing unit tests. Fuzzy testing is performed by Echidna.<\/li>\n<\/ol>\n<p><span style=\"font-weight: 400;\">After the audit, Ackee Blockchain and GoodGhosting agreed on a <strong><a href=\"https:\/\/ackeeblockchain.com\/blog\/glossary\/re-audit\/\">re-audit<\/a><\/strong>, which was completed on <strong>November 9, 2021<\/strong>. The <strong>main objective <\/strong>of the re-audit was to c<\/span>heck the correctness of the newly implemented logic for the winners&#8217; declaration and whether the discovered issues were correctly fixed.<\/p>\n<h4>Findings<\/h4>\n<p>Using our toolset, manual code review, unit and fuzzy testing led to <strong>the following\u00a0<a href=\"https:\/\/ackeeblockchain.com\/blog\/glossary\/findings\/\">findings<\/a><\/strong>:<\/p>\n<ul>\n<li>L1: Outdated compiler<\/li>\n<li>L2: Use of optimizer<\/li>\n<li>L3: Use of uint256 where uint8 is enough<\/li>\n<li>L4: Variable packing<\/li>\n<li>M1: Unlimited allowance<\/li>\n<li>M2: Renounce ownership<\/li>\n<li>H1: First player doesn\u2019t receive the bonus<\/li>\n<\/ul>\n<p><strong>4 low<\/strong> severity, <strong>2 medium<\/strong> severity and <strong>1 high<\/strong> severity issues were identified after the first audit.<\/p>\n<h4>Conclusion<\/h4>\n<p>Based on the audit report, the GoodGhosting team spent several weeks <strong>responsibly addressing the findings<\/strong>, and then, as noted above, the re-audit was completed on November 9, 2021.<\/p>\n<p><strong>All issues identified in the first audit were corrected<\/strong>;<span style=\"font-weight: 400;\">\u00a0one high severity issue (H1) and one medium severity issue (M1) were deprecated because all contracts addressed by these issues were no longer in use.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">We were delighted to audit <strong>GoodGhosting<\/strong> and look forward to working with them again.\u00a0<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><strong>The full Ackee Blockchain audit report of GoodGhosting with a more detailed description of all findings and recommendations can be found <a href=\"https:\/\/github.com\/Good-Ghosting\/goodghosting-protocol-v1\/blob\/master\/docs\/audits\/ackee-good-ghosting-core-files-audit.pdf\">here<\/a>.<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>About GoodGhosting GoodGhosting is a DeFi no-loss saving protocol that collects deposits from users and earns yield on those deposits through decentralized finance dapps like AAVE and Curve.<\/p>\n","protected":false},"author":11,"featured_media":194,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20,10],"tags":[21,58,33,52,57],"class_list":["post-192","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-audits","category-ethereum","tag-audit","tag-celo","tag-evm","tag-findings","tag-polygon"],"aioseo_notices":[],"featured_image_src":"https:\/\/ackee.xyz\/blog\/wp-content\/uploads\/2022\/04\/ABCH-Good-Ghosting-600x400.png","featured_image_src_square":"https:\/\/ackee.xyz\/blog\/wp-content\/uploads\/2022\/04\/ABCH-Good-Ghosting-600x600.png","author_info":{"display_name":"Andrea Nov\u00e1kov\u00e1","author_link":"https:\/\/ackee.xyz\/blog\/author\/andrea-novakova\/"},"_links":{"self":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/posts\/192","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/comments?post=192"}],"version-history":[{"count":0,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/posts\/192\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/media\/194"}],"wp:attachment":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/media?parent=192"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/categories?post=192"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/tags?post=192"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}