Plots

Smart Contract Audit Report

Executive Summary

This report presents the outcomes of our collaborative engagement with the Plots Finance team, focusing on the comprehensive evaluation of the PlotsCore, PlotsTreasury, and PlotsLend contracts.

Plots Finance is building a decentralized platform for borrowing and lending NFTs. Users can list their NFTs for others to borrow, while the platform's native VLND token is used for tokenization, backed by the Treasury's value.

Our team conducted an initial security assessment from September 9th to September 13th, 2024. On September 16th, 2024, our team amended this report to reflect updates made to the PlotsCore contract by the project team that resolves all findings.

Audit Scope

Audit Findings

All findings have been resolved. In addition, minimal centralized aspects are present.

require(
	AllLoans[AllLoansIndex[Collection][ID]].Borrower == msg.sender ||
	Admins[msg.sender] ||
	AllLoans[AllLoansIndex[Collection][ID]].Lender == msg.sender && 
	UsageExpirationUnix[Collection][ID] < block.timestamp || 
	msg.sender == Treasury,
	"Invalid loan"
);	

function ModifyCollection(address _collection, bool addRemove) public OnlyAdmin {
	if (addRemove) {
		require(!ListedCollectionsMap[_collection], "Collection already listed");
...

else {
	require(ListedCollectionsMap[_collection], "Collection not listed");

System Overview

The PlotsCore deployer will specify a list of addresses that will be granted Admin privileges. Any Admin address can add/remove any user's Admin privileges at any time. The Admin can permanently set the Treasury address and Lend address referenced in the contract one time.

Any Admin address can specify an NFT Collection address to add to the platform or remove from the platform at any time.

Any Admin address can specify a list of NFT collections and corresponding ETH values that will be linked together in the Treasury. Each collection address must have been previously listed in the PlotsCore contract.

Any user can initiate a deposit in the PlotsLend contract by specifying a Collection address that has been added to the platform and any of their owned NFT ID's from the collection. The specified NFT is transferred from the caller to the PlotsLend contract. The listing is added on behalf of the collection address and caller's address in the PlotsCore contract. Users may elect to initiate multiple deposits in a single transaction.

Any Admin address can initiate a deposit via the Treasury by specifying a Collection address that has been added to the platform and any of their owned NFT ID's from the collection. The specified NFT is transferred from the caller to the PlotsLend contract. The listing is added on behalf of both the collection address and the Treasury address in the PlotsCore contract. Admins may elect to initiate multiple deposits in a single transaction.

Any user can initiate the borrowing process by specifying a Collection address that has been listed, NFT ID, and a loan duration of either three or six months. The caller must not currently have an active loan associated with their address.

The loan is added to the list of active loans and the listing is removed from the platform. If the lender is the Treasury, the NFT is delegated to the borrower via the Treasury contract. If the lender is a different user (not the Treasury) the NFT is delegated to the borrower via the PlotsLend contract. The Delegation contracts are out of scope for this audit so our team is unable to provide an assessment with regard to their security.

Users can close an active loan for a specified NFT collection address and NFT ID. The caller must either be the borrower, the lender, an Admin, or the Treasury. If the caller is the lender, the loan must have expired before they can close it. The borrower, an Admin, or the Treasury can close a loan even if the loan has not expired. Upon closing the loan, the corresponding delegations are revoked via the Delegation contracts, and the NFT is either returned to its original owner or re-listed if the Treasury is involved. The system updates the loan records, marks the loan as closed, and removes the borrower’s active status.

Any user can initiate a withdrawal in the PlotsLend contract by specifying a Collection address and NFT ID they have previously deposited. If the NFT is currently listed in the Core contract, it is automatically delisted. The specified NFT is transferred from PlotsLend contract to the caller. Users may elect to initiate multiple withdrawals in a single transaction.

Any Admin address can initiate a withdrawal in the Treasury by specifying a Collection address and NFT ID that currently belongs to the Treasury. The specified NFT is transferred from the Treasury to the caller. The NFT is automatically delisted in the PlotsCore contract. Admins may elect to initiate multiple withdrawals in a single transaction.

Any Admin address can terminate active loans for multiple NFTs across different collections in a single transaction. Admins specify a list of Collection addresses and corresponding NFT IDs. The system automatically closes all active loans associated with the specified NFTs, and the borrowers may be optionally blacklisted, permanently preventing them from initiating any borrowing process in the future.

Any user can initiate a purchase of VLND tokens by providing an amount of ETH and a minimum amount of tokens that must be received for the transaction to successfully occur. The number of VLND tokens minted to the user is based on the amount of provided ETH and the current calculated price per token. This value must exceed the minimum amount specified by the caller.

Any user can sell a specified amount of VLND tokens for ETH at any time. The tokens are first transferred from the caller to the contract, where they are subsequently burned. The caller can also specify a minimum amount of ETH that must be received for the transaction to successfully occur. The contract’s ETH balance must remain above 5% of the total Treasury value after the transaction occurs. The calculated ETH amount is transferred from the contract to the caller.

Any Admin address can transfer all of the ETH or tokens from the Treasury contract to any recipient address at any time. Any Admin address can pause or unpause purchases and sells of the VLND token at any time. Any Admin address can set the VLND address referenced in the contract to any address at any time.

Vulnerability Analysis

About SourceHat

SourceHat has quickly grown to have one of the most experienced and well-equipped smart contract auditing teams in the industry. Our team has conducted 1800+ solidity smart contract audits covering all major project types and protocols, securing a total of over $50 billion U.S. dollars in on-chain value!
Our firm is well-reputed in the community and is trusted as a top smart contract auditing company for the review of solidity code, no matter how complex. Our team of experienced solidity smart contract auditors performs audits for tokens, NFTs, crowdsales, marketplaces, gambling games, financial protocols, and more!

Contact us today to get a free quote for a smart contract audit of your project!

What is a SourceHat Audit?

Typically, a smart contract audit is a comprehensive review process designed to discover logical errors, security vulnerabilities, and optimization opportunities within code. A SourceHat Audit takes this a step further by verifying economic logic to ensure the stability of smart contracts and highlighting privileged functionality to create a report that is easy to understand for developers and community members alike.

How Do I Interpret the Findings?

Each of our Findings will be labeled with a Severity level. We always recommend the team resolve High, Medium, and Low severity findings prior to deploying the code to the mainnet. Here is a breakdown on what each Severity level means for the project:

• High severity indicates that the issue puts a large number of users' funds at risk and has a high probability of exploitation, or the smart contract contains serious logical issues which can prevent the code from operating as intended.
• Medium severity issues are those which place at least some users' funds at risk and has a medium to high probability of exploitation.
• Low severity issues have a relatively minor risk association; these issues have a low probability of occurring or may have a minimal impact.
• Informational issues pose no immediate risk, but inform the project team of opportunities for gas optimizations and following smart contract security best practices.

• Go Home