{"id":259,"date":"2022-05-27T12:00:12","date_gmt":"2022-05-27T10:00:12","guid":{"rendered":"https:\/\/ackeeblockchain.com\/blog\/?p=259"},"modified":"2022-10-03T17:16:14","modified_gmt":"2022-10-03T15:16:14","slug":"safedao-vestingpool-audit-summary","status":"publish","type":"post","link":"https:\/\/ackee.xyz\/blog\/safedao-vestingpool-audit-summary\/","title":{"rendered":"SafeDAO: VestingPool Audit Summary"},"content":{"rendered":"

Gnosis Safe<\/a><\/span> engaged Ackee Blockchain<\/a><\/span>\u00a0to review and audit<\/a> <\/span> SafeDAO\u2019s VestingPool contract between May 23 and 27, 2022<\/b>. The entire audit process was conducted with a total time commitment of 2 engineering days<\/b>. We now publish a summary of our results.<\/p>\n

Methodology<\/b><\/h4>\n

We start by reviewing the specifications, sources, and instructions provided to us, which is essential to ensure we understand the project’s size, scope, and functionality. This is followed by due diligence using the automated Solidity<\/span><\/a> analysis tools and Slither<\/span><\/a>.<\/p>\n

In addition to tool-based analysis, we continue with a detailed manual code review, which is the process of reading the source code line by line to identify potential vulnerabilities or code duplications. When the code review is complete, we run unit tests to ensure the system works as expected and potentially write missing unit or fuzzy tests. We also deploy the contracts<\/span><\/a> locally and try to attack and break the system.<\/p>\n

Scope\u00a0<\/b><\/h4>\n

We audited commit a<\/em>50728c28dd510ceae1b65bb526db98148a76f31<\/i> of the safe-global\/safe-token<\/span><\/a>\u00a0repository.<\/p>\n

During the security review, we focused on <\/b>discovering issues, vulnerabilities, and gas optimizations in the source code of SafeDAO\u2019s VestingPool contract<\/span><\/a>.<\/p>\n

Findings<\/b><\/h4>\n

Here we present our findings<\/span><\/a>.<\/p>\n

Critical severity\u00a0<\/b><\/h5>\n

No critical severity issues were found.<\/p>\n

High severity\u00a0<\/b><\/h5>\n

No high severity issues were found.<\/p>\n

Medium severity<\/b><\/h5>\n

M1: <\/b>Pool Manager role\u00a0<\/span><\/p>\n

Low severity<\/b><\/h5>\n

No low severity issues were found.\u00a0<\/span><\/p>\n

Warning severity\u00a0<\/b><\/h5>\n

No warning severity issues were found.<\/span><\/p>\n

\n
\n
\n
Informational severity\u00a0<\/b><\/h5>\n<\/div>\n<\/div>\n<\/div>\n

I1: <\/b>Public functions\u00a0<\/span><\/p>\n

I2: <\/b>Typos in the comments\u00a0<\/span><\/p>\n

I3: <\/b>Possible gas optimization in claimVestedTokens()\u00a0<\/span><\/i><\/span><\/p>\n

Conclusion<\/b><\/h4>\n

Our review resulted in 4 findings<\/b> ranging from Informational<\/i> to Medium <\/i>severity.<\/p>\n

Generally, we can state that the code quality is<\/b> very high, <\/b>and the code is well commented. The documentation is sufficient, and the client\u2019s test coverage is nearly 100%.<\/i><\/p>\n

Update: <\/b>On\u00a0June 23, 2022<\/b>,\u00a0Gnosis Safe provided an updated codebase that\u00a0addresses the reported issues. Some of the findings (I2, I3) were acknowledged and fixed, and the rest (M1, I1) were marked as “not an issue” after additional information was provided.<\/p>\n

 <\/p>\n

Ackee Blockchain’s full SafeDAO\u2019s VestingPool contract <\/i>audit report with a more detailed description of all findings and recommendations can be found <\/b>here<\/b><\/span><\/a>.<\/b><\/p>\n

 <\/p>\n

We were delighted to audit Gnosis Safe<\/b>\u00a0and look forward to working with them again.<\/p>\n","protected":false},"excerpt":{"rendered":"

Gnosis Safe engaged Ackee Blockchain\u00a0to review and audit SafeDAO\u2019s VestingPool contract between May 23 and 27, 2022. The entire audit process was conducted with a total time commitment of 2 engineering days. We now publish a summary of our results.<\/p>\n","protected":false},"author":11,"featured_media":274,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20,10],"tags":[21,27,24,33,76,73,64,28],"class_list":["post-259","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-audits","category-ethereum","tag-audit","tag-blockchain","tag-ethereum","tag-evm","tag-gnosis-safe","tag-safe-token","tag-security","tag-smart-contract"],"aioseo_notices":[],"featured_image_src":"https:\/\/ackee.xyz\/blog\/wp-content\/uploads\/2022\/08\/ABCH-Gnosis-safe@2x-600x400.png","featured_image_src_square":"https:\/\/ackee.xyz\/blog\/wp-content\/uploads\/2022\/08\/ABCH-Gnosis-safe@2x-600x600.png","author_info":{"display_name":"Andrea Nov\u00e1kov\u00e1","author_link":"https:\/\/ackee.xyz\/blog\/author\/andrea-novakova\/"},"_links":{"self":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/posts\/259","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/comments?post=259"}],"version-history":[{"count":0,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/posts\/259\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/media\/274"}],"wp:attachment":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/media?parent=259"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/categories?post=259"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/tags?post=259"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}