Fungi Marketplace

Smart Contract Audit Report

Executive Summary

This report presents the outcomes of our collaborative engagement with the Fungi team, focusing on the comprehensive evaluation of the Marketplace contract.

Our team conducted an initial security assessment from April 10th to April 15th, 2024. On April 17th, our team amended this report to reflect changes made to the contracts to resolve the findings we had identified during our initial review from commit ddbfb79 to commit c168803.

Fungi is building a new Marketplace where users can list ERC-20 tokens for sale and specify their desired payment.

Audit Scope

Name	Source Code	Visualized
Marketplace	`c168803`	Inheritance Chart. Function Graph.

Name	Address/Source Code	Visualized
Marketplace	`c168803`	Inheritance Chart. Function Graph.

Audit Findings

All findings have been resolved.

Finding #1	Marketplace	HighResolved
Finding #1 - Marketplace ResolvedResolved
Description: The _trade_buy() function mistakenly uses `trade.item_count` rather than `trade.currency_count` when calculating the `fee` and `count_to_owner` values. Risk/Impact: The incorrect number of currency tokens will always be used when calculating and transferring the fee to the `fee_address` and the payment to the trade owner. As a result, the transaction will either revert during the transfer if the contract does not have a sufficient token balance or revert due to the require statement in the _trade_buy() function. Recommendation: `trade.currency_count` should be used when setting the `count_to_owner` and `fee` values in the _trade_buy() function. Resolution: The team has implemented the above recommendation.
Finding #2	Marketplace	HighResolved
Finding #2 - Marketplace HighResolved
Description: The _trade_buy() function mistakenly uses `trade.item_count` rather than `trade.currency_count` when calculating the `dif` value to transfer back to the user. Risk/Impact: The amount of ETH to be returned to the caller will consistently be incorrect as the wrong value is being used in the calculation. Recommendation: `trade.currency_count` should be used when calculating the `dif` value in the _trade_buy() function to transfer the correct ETH amount. Resolution: The team has implemented the above recommendation.
Finding #3	Marketplace	LowResolved
Finding #3 - Marketplace LowResolved
Description: The trade_delete() function is vulnerable to reentrancy in the event that the item token address is set to an ERC-777 compliant token. Risk/Impact: If the same ERC-777 compliant token is deposited by more than one user, a malicious trade owner can reenter the trade_delete() function by use of the token's fallback function. This would allow the user to withdraw more tokens from the contract than they have deposited, resulting in the theft of tokens that were deposited by other users. Recommendation: The logic in the trade_delete() function should be modified to follow the Checks-Effects-Interactions pattern. The `trade.item_count` transfer amount should be stored in a local variable and the `state` of the trade update and decrementing of `_trades_for_sale_count` should occur before the token transfer executes. Alternatively, the team could add the nonReentrant() modifier to the trade_delete() function. Resolution: The team has restructured the logic to follow the Checks-Effects-Interactions pattern. They have also added the nonReentrant() modifier to the trade_delete() function.

System Overview

TRADE CREATION

Any user can initiate a trade creation process by specifying the owner of the trade, item address, number of item tokens for sale, currency address, and number of currency tokens needed for payment. If the 0x00 address is specified as the currency token, the currency will be in ETH. A new Holder contract is created in the process. The specified number of item tokens are transferred from the caller to the Holder contract. Tokens that charge a fee on transfers are prohibited from being used.

TRADE DELETION

The owner assigned to an active trade can delete the trade at any time. The originally provided item tokens are transferred from the Holder contract to the trade owner.

PURCHASES

Any user can specify the ID of an active trade to initiate a purchase for at any time. A fee is calculated based on the share percentage assigned to the trade during creation. The calculated fee amount is transferred from the caller to the Fee address set by the team. The currency amount is transferred from the caller to the owner of the trade in the form of the currency token. The caller must grant the contract a sufficient allowance in order for the transfers to successfully occur if the payment is with an ERC-20 token. If the currency is ETH, any excess ETH provided by the caller is returned to their address. The number of item tokens are transferred from the Holder contract to the caller.

The owner can set the purchase fee to any value up to 10 (0.1%) at any time. The owner can set the Fee address to any address at any time.

Vulnerability Analysis

Vulnerability Category	Notes	Result
Arbitrary Jump/Storage Write	N/A	PASS
Centralization of Control	N/A	PASS
Compiler Issues	N/A	PASS
Delegate Call to Untrusted Contract	N/A	PASS
Dependence on Predictable Variables	N/A	PASS
Ether/Token Theft	N/A	PASS
Flash Loans	N/A	PASS
Front Running	N/A	PASS
Improper Events	N/A	PASS
Improper Authorization Scheme	N/A	PASS
Integer Over/Underflow	N/A	PASS
Logical Issues	N/A	PASS
Oracle Issues	N/A	PASS
Outdated Compiler Version	N/A	PASS
Race Conditions	N/A	PASS
Reentrancy	N/A	PASS
Signature Issues	N/A	PASS
Sybil Attack	N/A	PASS
Unbounded Loops	N/A	PASS
Unused Code	N/A	PASS
Overall Contract Safety		PASS

About SourceHat

SourceHat has quickly grown to have one of the most experienced and well-equipped smart contract auditing teams in the industry. Our team has conducted 1800+ solidity smart contract audits covering all major project types and protocols, securing a total of over $50 billion U.S. dollars in on-chain value!
Our firm is well-reputed in the community and is trusted as a top smart contract auditing company for the review of solidity code, no matter how complex. Our team of experienced solidity smart contract auditors performs audits for tokens, NFTs, crowdsales, marketplaces, gambling games, financial protocols, and more!

What is a SourceHat Audit?

Typically, a smart contract audit is a comprehensive review process designed to discover logical errors, security vulnerabilities, and optimization opportunities within code. A SourceHat Audit takes this a step further by verifying economic logic to ensure the stability of smart contracts and highlighting privileged functionality to create a report that is easy to understand for developers and community members alike.

How Do I Interpret the Findings?

Each of our Findings will be labeled with a Severity level. We always recommend the team resolve High, Medium, and Low severity findings prior to deploying the code to the mainnet. Here is a breakdown on what each Severity level means for the project:

High severity indicates that the issue puts a large number of users' funds at risk and has a high probability of exploitation, or the smart contract contains serious logical issues which can prevent the code from operating as intended.
Medium severity issues are those which place at least some users' funds at risk and has a medium to high probability of exploitation.
Low severity issues have a relatively minor risk association; these issues have a low probability of occurring or may have a minimal impact.
Informational issues pose no immediate risk, but inform the project team of opportunities for gas optimizations and following smart contract security best practices.

Go Home