Swirl Locker

Smart Contract Audit Report

Audit Summary

Swirl Tools is building a new platform where users can lock tokens for a duration of time.

For this audit, we reviewed the TokensLocker contract provided to us by the project team.

Audit Findings

All findings have been resolved.
Date: April 20th, 2023.
Updated: April 21st, 2023 to reflect updates made to the contract that resolves all Findings.

Finding #1 - TokensLocker - High (Resolved)

Description: The unlock() function is vulnerable to reentrancy attacks if any user initiates a lock using an ERC-777 compliant token.
Risk/Impact: If a malicious user locks the same ERC-777 compliant token, they can reenter the unlock() function through the token's fallback function. This would allow them to withdraw more tokens from the contract than they have locked, resulting in the theft of tokens that were locked by other users.
Recommendation: The logic in the unlock() function should be modified to follow the Checks-Effects-Interactions pattern as follows:

function unlock(uint256 _index) public {
...

userLock.isWithdrawn = true;
IERC20(_token).transfer(msg.sender, _amount);

Resolution: The team has implemented the above recommendation.

---

Finding #2 - TokensLocker - Low (Resolved)

Description: Any excess ETH supplied to the contract to cover the cost of the Platform fee when initiating a lock is not returned to the user.
Risk/Impact: Users will lose any excess ETH sent as payment.
Recommendation: The contract should require the user supplies the exact amount of ETH needed to cover the cost of the Platform fee.
Resolution: The team has implemented the above recommendation.

Contract Overview

• Any user can use this contract to lock tokens for a specified amount of time and claim them at a later date.
• Any user can initiate a new lock by specifying a token address, a token amount, and an unlock time.
• The user must also provide an amount of ETH to cover the cost of the contract's Platform fee.
• The specified number of tokens are transferred from the caller to the contract. The user must grant the contract a sufficient allowance in order for the transaction to successfully occur.
• The contract assigns a unique lock ID number to each lock created by the user.
• Any user can that has locked tokens can specify a lock ID to unlock once the unlock time associated with the lock ID has passed.
• The full number of locked tokens are transferred from the contract to the caller's wallet address.
• The owner can set the Platform fee to any value at any time.
• The owner can withdraw all of the ETH from the contract at any time.

Audit Results

Inheritance Chart

Function Graph

Functions Overview

 ($) = payable function
 # = non-constant function
 
 Int = Internal
 Ext = External
 Pub = Public

 + [Int] IERC20 
    - [Ext] totalSupply
    - [Ext] balanceOf
    - [Ext] transfer #
    - [Ext] allowance
    - [Ext] approve #
    - [Ext] transferFrom #

 +  Context 
    - [Int] _msgSender
    - [Int] _msgData

 + [Int] IERC20Metadata (IERC20)
    - [Ext] name
    - [Ext] symbol
    - [Ext] decimals

 +  ERC20 (Context, IERC20, IERC20Metadata)
    - [Pub]  #
    - [Pub] name
    - [Pub] symbol
    - [Pub] decimals
    - [Pub] totalSupply
    - [Pub] balanceOf
    - [Pub] transfer #
    - [Pub] allowance
    - [Pub] approve #
    - [Pub] transferFrom #
    - [Pub] increaseAllowance #
    - [Pub] decreaseAllowance #
    - [Int] _transfer #
    - [Int] _mint #
    - [Int] _burn #
    - [Int] _approve #
    - [Int] _spendAllowance #
    - [Int] _beforeTokenTransfer #
    - [Int] _afterTokenTransfer #

 +  Ownable (Context)
    - [Pub]  #
    - [Pub] owner
    - [Int] _checkOwner
    - [Pub] renounceOwnership #
       - modifiers: onlyOwner
    - [Pub] transferOwnership #
       - modifiers: onlyOwner
    - [Int] _transferOwnership #

 +  ReentrancyGuard 
    - [Pub]  #
    - [Prv] _nonReentrantBefore #
    - [Prv] _nonReentrantAfter #
    - [Int] _reentrancyGuardEntered

 +  TokensLocker (Ownable, ReentrancyGuard)
    - [Pub]  #
    - [Pub] lock ($)
    - [Pub] unlock #
       - modifiers: nonReentrant
    - [Pub] changePlatformFee #
       - modifiers: onlyOwner
    - [Pub] withdrawEth #
       - modifiers: onlyOwner
    - [Pub] getUserInfo
    - [Pub] getUserLockInfo

About SourceHat

SourceHat has quickly grown to have one of the most experienced and well-equipped smart contract auditing teams in the industry. Our team has conducted 1800+ solidity smart contract audits covering all major project types and protocols, securing a total of over $50 billion U.S. dollars in on-chain value!
Our firm is well-reputed in the community and is trusted as a top smart contract auditing company for the review of solidity code, no matter how complex. Our team of experienced solidity smart contract auditors performs audits for tokens, NFTs, crowdsales, marketplaces, gambling games, financial protocols, and more!

Contact us today to get a free quote for a smart contract audit of your project!

What is a SourceHat Audit?

Typically, a smart contract audit is a comprehensive review process designed to discover logical errors, security vulnerabilities, and optimization opportunities within code. A SourceHat Audit takes this a step further by verifying economic logic to ensure the stability of smart contracts and highlighting privileged functionality to create a report that is easy to understand for developers and community members alike.

How Do I Interpret the Findings?

Each of our Findings will be labeled with a Severity level. We always recommend the team resolve High, Medium, and Low severity findings prior to deploying the code to the mainnet. Here is a breakdown on what each Severity level means for the project:

• High severity indicates that the issue puts a large number of users' funds at risk and has a high probability of exploitation, or the smart contract contains serious logical issues which can prevent the code from operating as intended.
• Medium severity issues are those which place at least some users' funds at risk and has a medium to high probability of exploitation.
• Low severity issues have a relatively minor risk association; these issues have a low probability of occurring or may have a minimal impact.
• Informational issues pose no immediate risk, but inform the project team of opportunities for gas optimizations and following smart contract security best practices.

• Go Home