Fungi

Smart Contract Audit Report

Executive Summary

This report presents the outcomes of our collaborative engagement with a client who requested a comprehensive review of the Fungi contract. The client is keen on exploring the functionality of this code for research and future development, despite having no affiliation with the Fungi team.

Our team conducted an initial security assessment from April 8th to April 12th, 2024. On April 15th, our team amended this report to reflect changes made to the contracts to resolve findings #1 & #2 we had identified during our initial review from commit 4581acb to commit 0c47ff8. On April 23rd, our team further amended this report to reflect changes made to the contract by the project team.

Fungi is a new ERC-20i token that integrates the traditional fungibility of ERC-20 tokens with unique "inscription" data, making each token both fungible and unique.

Audit Scope

Audit Findings

An Informational finding was identified and the team may want to review it.

function _removeHolder(address account) private {
	if (_holdersCount == 0) return;

	uint removingIndex = _holderListIndexes[account];
	if (removingIndex != _holdersCount - 1) {
		address lastHolder = _holderList[_holdersCount - 1];
		_holderList[removingIndex] = lastHolder;
		_holderListIndexes[lastHolder] = removingIndex;
	}

	--_holdersCount;
	delete _holderListIndexes[account];
	delete _holderList[_holdersCount];
}

System Overview

The total supply of the token is set to 210 million $FUNGI (210,000,000). No mint functions are accessible beyond deployment. Any user can burn their own tokens at any time by initiating a transfer to the 0x00 address.

The deployer is set as the Pair creator address upon deployment. The Pair creator can launch the contract one time by specifying the liquidity pool address that will be referenced on transfers. The timestamp of the transaction is stored as the contract's start time.

The pool address must be set before all transfers can take place on the platform. Only transfers where the owner is either the sender or the recipient can occur before the pool address has been set.

The contract features a dynamic maximum buy amount that starts at 0.05% of the initial total supply and linearly increases by 0.005% of the initial total supply for every second that passes since the contract's start time is established.

Upon executing a token transfer not involving the pool address, if the sender's entire seed balance is equivalent to the seed value of the transfer, it is recognized as a growing inscription being transferred between users. The sender's seed amount is decreased and is credited to the recipient, effectively transferring ownership of the inscription.

Upon executing a transfer for a specific inscription identified by its seed, the system first verifies that the inscription is owned by the sender and not already owned by the recipient. A direct asset transfer is then facilitated from the sender to the recipient.

Upon executing a buy or sell via the pool address, tokens representing spores are exchanged. The spore counts are updated for the user accordingly, increasing for a purchase and decreasing for a sell.

The contract maintains a list of holders, where users are designated as holders if the combined total value of their seed and inscription amounts exceeds zero after the seed transfer occurs.

A unique 'extra' value is updated for users when adding or removing seeds assigned to their address based on the contract's unique nonce identifier. Each user's seed and extra values are used to retrieve data representing an SVG image.

The owner can modify the stems, caps, spores, and dots of inscriptions within the contract by specifying their preferred attributes at any time. The owner sets the rarity level, assigns a unique identifier, and provides a list of structures that define the dimensions and positioning of each element's graphical representation.

Vulnerability Analysis

About SourceHat

SourceHat has quickly grown to have one of the most experienced and well-equipped smart contract auditing teams in the industry. Our team has conducted 1800+ solidity smart contract audits covering all major project types and protocols, securing a total of over $50 billion U.S. dollars in on-chain value!
Our firm is well-reputed in the community and is trusted as a top smart contract auditing company for the review of solidity code, no matter how complex. Our team of experienced solidity smart contract auditors performs audits for tokens, NFTs, crowdsales, marketplaces, gambling games, financial protocols, and more!

Contact us today to get a free quote for a smart contract audit of your project!

What is a SourceHat Audit?

Typically, a smart contract audit is a comprehensive review process designed to discover logical errors, security vulnerabilities, and optimization opportunities within code. A SourceHat Audit takes this a step further by verifying economic logic to ensure the stability of smart contracts and highlighting privileged functionality to create a report that is easy to understand for developers and community members alike.

How Do I Interpret the Findings?

Each of our Findings will be labeled with a Severity level. We always recommend the team resolve High, Medium, and Low severity findings prior to deploying the code to the mainnet. Here is a breakdown on what each Severity level means for the project:

• High severity indicates that the issue puts a large number of users' funds at risk and has a high probability of exploitation, or the smart contract contains serious logical issues which can prevent the code from operating as intended.
• Medium severity issues are those which place at least some users' funds at risk and has a medium to high probability of exploitation.
• Low severity issues have a relatively minor risk association; these issues have a low probability of occurring or may have a minimal impact.
• Informational issues pose no immediate risk, but inform the project team of opportunities for gas optimizations and following smart contract security best practices.

• Go Home