{"id":548,"date":"2023-08-24T09:59:24","date_gmt":"2023-08-24T07:59:24","guid":{"rendered":"https:\/\/ackeeblockchain.com\/blog\/?p=548"},"modified":"2025-02-19T14:08:30","modified_gmt":"2025-02-19T12:08:30","slug":"monerium-audit-summary","status":"publish","type":"post","link":"https:\/\/ackee.xyz\/blog\/monerium-audit-summary\/","title":{"rendered":"Monerium: Audit Summary"},"content":{"rendered":"<p><a href=\"https:\/\/monerium.com\/\" target=\"_blank\" rel=\"noopener\">Monerium<\/a><span style=\"font-weight: 400;\"> is a financial technology company with the mission of making digital currency accessible, secure, and simple to transact. It is the first Electronic Money Institution (EMI) licensed to issue fiat currencies onto blockchains. Monerium is authorized in the 27 European Union Member States, Iceland, Liechtenstein and Norway.<br \/>\n<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Monerium engaged Ackee Blockchain to perform a security review of the Monerium protocol with a total time donation of <\/span><b>12 engineering days<\/b><span style=\"font-weight: 400;\"> in a period between <\/span><b>June 15 and July 4, 2023<\/b><span style=\"font-weight: 400;\">.<\/span><\/p>\n<h2><b>REGULATIONS IN CRYPTO<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Monerium EMI ehf. is authorized and regulated as and Electronic Money Institution under the Icelandic Electronic Money Act No. 17\/2013 which implements the European Directive 2009\/110\/EC on the taking up, pursuit and prudential supervision of the business of electronic money institutions.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The importance of crypto regulations became clear as <\/span><a href=\"https:\/\/www.consilium.europa.eu\/en\/press\/press-releases\/2023\/05\/16\/digital-finance-council-adopts-new-rules-on-markets-in-crypto-assets-mica\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Markets in Crypto-Assets Regulation (MiCA)<\/span><\/a><span style=\"font-weight: 400;\"> was introduced. MiCA is a regulatory framework proposed by the European Commission to address the growing use of cryptocurrencies and other crypto-assets within the European Union (EU) which entered into force in June 2023. One of the outcomes of MiCA is a requirement on regular audits (every six months) by independent (3rd party) auditors, such as Ackee Blockchain.<\/span><\/p>\n<h2><b>EURE ELECTRONIC MONEY (EMONEY)<\/b><\/h2>\n<p>Monerium&#8217;s e-money, known as <a href=\"https:\/\/dune.com\/dcooper\/eure\" target=\"_blank\" rel=\"noopener\">EURe<\/a>, is a digital alternative to cash, stored electronically and backed 1:1 by high-quality liquid assets. As a regulated entity, Monerium ensures seamless transfers between bank accounts and blockchain wallets. Unlike traditional bank deposits, e-money funds are held in segregated accounts, providing extra security and reliability. Recognized within the European Union, EURe offers a legally de-risked, stable form of digital currency, enhancing financial transactions&#8217; efficiency and safety.<\/p>\n<h2><b>METHODOLOGY<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">We began our review by using static analysis tools, namely <\/span><span style=\"font-weight: 400;\">Woke<\/span><span style=\"font-weight: 400;\">. We then took a deep dive into the logic of the contracts. For testing, we have involved <\/span><span style=\"font-weight: 400;\">Woke <\/span><span style=\"font-weight: 400;\">testing framework. During the review, we paid special attention to:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">ensuring the access controls are not too relaxed or too strict<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">identification of potential reentrancies in the code<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">verification of the system\u2019s arithmetic integrity<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">detection of common problems, including data validation issues<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">compliance with the best practices.\u00a0<\/span><\/li>\n<\/ul>\n<h2><b>SCOPE <\/b><\/h2>\n<p><span style=\"font-weight: 400;\">The scope of the audit covered all contracts in the protocol, commit <\/span><span style=\"font-weight: 400;\">2ff1709<\/span><span style=\"font-weight: 400;\">.<\/span><\/p>\n<h2><b>FINDINGS<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Here we present our <\/span><span style=\"font-weight: 400;\">fi<\/span><span style=\"font-weight: 400;\">n<\/span><span style=\"font-weight: 400;\">dings<\/span><span style=\"font-weight: 400;\">.<\/span><\/p>\n<h3><b>Critical severity\u00a0<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">No critical severity issues were found.\u00a0<\/span><\/p>\n<h3><b>High severity\u00a0<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">No high severity issues were found.\u00a0<\/span><\/p>\n<h3><b>Medium severity<\/b><\/h3>\n<p><b>M1:<\/b><span style=\"font-weight: 400;\"> Access control architecture<\/span><\/p>\n<p><b>M2:<\/b><span style=\"font-weight: 400;\"> Renounce ownership<\/span><\/p>\n<p><b>M3:<\/b><span style=\"font-weight: 400;\"> Weak ownership<\/span><\/p>\n<p><b>M4:<\/b><span style=\"font-weight: 400;\"> Unchecked return values <\/span><\/p>\n<p><b>M5: <\/b><span style=\"font-weight: 400;\">Missing decimals validation\u00a0<\/span><\/p>\n<h3><b>Low severity<\/b><\/h3>\n<p><b>L1: <\/b><span style=\"font-weight: 400;\">Missing validations<\/span><b>\u00a0<\/b><\/p>\n<h3><b>Warning severity <\/b><\/h3>\n<p><b>W1:<\/b><span style=\"font-weight: 400;\"> Impossible to remove bridgeFrontend<\/span><\/p>\n<p><b>W2:<\/b><span style=\"font-weight: 400;\"> Unprotected functions<\/span><\/p>\n<p><b>W3:<\/b><span style=\"font-weight: 400;\"> Missing events<\/span><\/p>\n<p><b>W4<\/b><span style=\"font-weight: 400;\">: Duplicated event\u00a0<\/span><\/p>\n<p><b>W5:<\/b><span style=\"font-weight: 400;\"> Testing contracts <\/span><\/p>\n<p><b>W6:<\/b><span style=\"font-weight: 400;\"> Multiple compiler versions <\/span><\/p>\n<h3><b>Informational severity <\/b><\/h3>\n<p><b>I1: <\/b><span style=\"font-weight: 400;\">Unused library\u00a0\u00a0<\/span><\/p>\n<p><b>I2: <\/b><span style=\"font-weight: 400;\">Unused variables <\/span><\/p>\n<p><b>I3: <\/b><span style=\"font-weight: 400;\">Naming conventions<\/span><b>\u00a0<\/b><\/p>\n<p><b>I4: <\/b><span style=\"font-weight: 400;\">Unnecessary SafeMath <\/span><\/p>\n<p><b>I5:<\/b><span style=\"font-weight: 400;\"> Typos<\/span><b>\u00a0<\/b><\/p>\n<p><b>I6: <\/b><span style=\"font-weight: 400;\">Inconsistent uint syntax<\/span><\/p>\n<h2><b>CONCLUSION<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Our review resulted in 18 findings, ranging from <\/span><i><span style=\"font-weight: 400;\">Info<\/span><\/i><span style=\"font-weight: 400;\"> to <\/span><i><span style=\"font-weight: 400;\">Medium<\/span><\/i><span style=\"font-weight: 400;\"> severity. The most severe ones are related to ownership, access control and data validations. These issues aren\u2019t a direct threat but they can create vulnerabilities due to human errors in the future. Of particular concern is the owner\u2019s multi-sig scheme of 2\/6, which is severely weak.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The overall code quality and architecture are not the best and contain many violations of Solidity development best practices like data validations, unused code, naming conventions, etc.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Ackee Blockchain recommends Monerium to:\u00a0<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">increase owner\u2019s multi-sig threshold<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">review and fix the access control architecture<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">ensure return values are always validated<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">separate production contracts from testing contracts, \u2022 remove unused code from the codebase<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">address all other reported issues.\u00a0<\/span><\/li>\n<\/ul>\n<p><b>UPDATE: <\/b><span style=\"font-weight: 400;\">The review was done on the given commit: <\/span><span style=\"font-weight: 400;\">3477259<\/span><span style=\"font-weight: 400;\">. Monerium fixed all medium-severity issues and the multi-sig scheme has been increased to 3\/6. The only acknowledged issue <\/span><span style=\"font-weight: 400;\">L1 <\/span><span style=\"font-weight: 400;\">is not addressed because of the planned redesign.\u00a0<\/span><\/p>\n<div class=\"page\" title=\"Page 10\">\n<div class=\"layoutArea\">\n<div class=\"column\">\n<p>The updated fix review was done on the commit 40c7c17, which reverts the fix of M5: Missing decimals validation. The client decided to only acknowledge the issue due to the low likelihood and complicated upgrade\/migration process of TokenStorage contract.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<p><b>Ackee Blockchain\u2019s full <\/b><b><i>Monerium<\/i><\/b><b> audit report with a more detailed description of all findings and recommendations can be found <\/b><a href=\"https:\/\/github.com\/Ackee-Blockchain\/public-audit-reports\/blob\/master\/2024\/ackee-blockchain-monerium-smart-contracts-report.pdf\" target=\"_blank\" rel=\"noopener\"><b>here<\/b><\/a><b>.<\/b><\/p>\n<p><span style=\"font-weight: 400;\">We were delighted to audit<\/span><b> Monerium<\/b><span style=\"font-weight: 400;\"> and look forward to working with them again.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Monerium is a financial technology company with the mission of making digital currency accessible, secure, and simple to transact. It is the first Electronic Money Institution (EMI) licensed to issue fiat currencies onto blockchains. Monerium is authorized in the 27 European Union Member States, Iceland, Liechtenstein and Norway. Monerium engaged Ackee Blockchain to perform a security review of the Monerium protocol with&hellip;<\/p>\n","protected":false},"author":15,"featured_media":549,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20,10,80],"tags":[21,24,115,68],"class_list":["post-548","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-audits","category-ethereum","category-solidity","tag-audit","tag-ethereum","tag-monerium","tag-solidity"],"aioseo_notices":[],"featured_image_src":"https:\/\/ackee.xyz\/blog\/wp-content\/uploads\/2023\/08\/Monerium_blog-600x400.png","featured_image_src_square":"https:\/\/ackee.xyz\/blog\/wp-content\/uploads\/2023\/08\/Monerium_blog-600x600.png","author_info":{"display_name":"Aleksandra Yudina","author_link":"https:\/\/ackee.xyz\/blog\/author\/aleksandra-yudina\/"},"_links":{"self":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/posts\/548","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/comments?post=548"}],"version-history":[{"count":0,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/posts\/548\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/media\/549"}],"wp:attachment":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/media?parent=548"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/categories?post=548"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/tags?post=548"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}