- Total Prize Pool: $30,000 in USDC
- HM awards: $24,000 in USDC
- QA awards: $900 in USDC
- Judge awards: $2,800 in USDC
- Validator awards: $1,800 USDC
- Scout awards: $500 in USDC
- Read our guidelines for more details
- Starts August 22, 2024 20:00 UTC
- Ends September 3, 2024 20:00 UTC
The 4naly3er report can be found here.
Note for C4 wardens: Anything included in this Automated Findings / Publicly Known Issues section is considered a
publicly known issue and is ineligible for awards.
- updateArtSettings allows setting the startTime to a past timestamp, potentially opening the minting window earlier than intended
- Setting sellRoyalty higher than buyRoyalty may reduce market demand possibly leading to decreased liquidity
- Lack of upper bound check for mintFee
- User can claim multiple NFT (not check claimed status)
- creatorFee to be always zero when supply == 0
- Solady ECDSA.recover(), which does not reject malleable signature. For this issue, we use expiresIn
- The credMerkleRoot[credChainId][credId] stores the merkleRootHash, but there is no way to update the merkleRootHash.
- OZ EnumerableMap is not gas efficiency
Phi Protocol is an open credentialing protocol to help users form, visualize, showcase their onchain identity. It incentivizes individuals to index blockchain transaction data as onchain credential blocks, curate them, host the verification process, and mint onchain credential contents.
- Previous audits: https://github.com/code-423n4/2024-08-phi/tree/main/docs/audit
- Documentation: https://docs.philand.xyz/explore-phi
- Website: https://phiprotocol.xyz/
- X/Twitter: https://x.com/phi_xyz
- Discord: https://discord.gg/phi
| Question | Answer |
|---|---|
| ERC20 used by the protocol | None |
| Test coverage | 55% |
| ERC721 used by the protocol | None |
| ERC777 used by the protocol | None |
| ERC1155 used by the protocol | Any |
| Chains the protocol will be deployed on | Base, Optimism, BeraChain, and Other EVM chain |
| Question | Answer |
|---|---|
| Missing return values | In scope |
| Fee on transfer | In scope |
| Balance changes outside of transfers | In scope |
| Upgradeability | In scope |
| Flash minting | In scope |
| Pausability | In scope |
| Approval race protections | In scope |
| Revert on approval to zero address | In scope |
| Revert on zero value approvals | In scope |
| Revert on zero value transfers | In scope |
| Revert on transfer to the zero address | In scope |
| Revert on large approvals and/or transfers | In scope |
| Doesn't revert on failure | In scope |
| Multiple token addresses | In scope |
| Low decimals ( < 6) | In scope |
| High decimals ( > 18) | In scope |
| Blocklists | In scope |
| Question | Answer |
|---|---|
| Enabling/disabling fees (e.g. Blur disables/enables fees) | No |
| Pausability (e.g. Uniswap pool gets paused) | No |
| Upgradeability (e.g. Uniswap gets upgraded) | No |
| Question | Answer |
|---|---|
| src/art/PhiNFT1155.sol | ERC1155 |
- Our demo for audit: https://base-sepolia.terminal.phiprotocol.xyz/
- Creating CREDs with identical conditions is possible, therefore buying up shares has little significance.
- Security: Identify and mitigate vulnerabilities to prevent exploits and attacks.
2.a. Function Reliability: Ensure the contract behaves consistently under various conditions.
2.b. Function Correctness: Ensure the smart contract logic correctly implements the intended functionality without errors.
- Gas Efficiency
Security Concerns - Access Control, Signature Verification, Reply Protection, Data integrity
- Does the access control mechanism correctly restrict access to sensitive functions?
- Can the signature verification function correctly verify the required signatures?
- Does the function handling signature proofs properly reject invalid or malicious proofs?
Functional Reliability/Correctness Concerns
- Are there any issues arising when claiming multiple amounts or performing batch processing?
- Is there any unnecessary accumulation of ETH in the contract
- Does the contract emit all necessary events correctly and include appropriate data?
- Are there any potential issues or concerns when utilizing different bonding curves with CRED
- Are there any potential issues with emitting events or executing functions when using Decent or relayer protocols?
- Does the contract have proper error handling and revert statements for invalid inputs, unauthorized access, and other potential failure scenarios?
- Is it possible to intentionally target a halt when using loops?
Gas Efficiency: Verify that the contract performs optimally without unnecessary gas consumption.
- Can the contract be optimized for gas efficiency, particularly in loops and storage access patterns?
| Role | Description |
|---|---|
| Owner | Signature Signer |
| User Groups | Link to doc |
- Docs: https://docs.philand.xyz/explore-phi/phi-protocol/phi-protocol-rewards/curator-reward
- Also, You can check our Share price curve (Google Doc)
git clone --recurse https://github.com/code-423n4/2024-08-phi.git
git 2024-08-phi
git submodule update --init --recursive
bun install
forge test -vvvforge coverage's output:
See scope.txt
| File | Logic Contracts | nSLOC | Libraries used |
|---|---|---|---|
| /src/Cred.sol | 1 | 507 | @openzeppelin/contracts/utils/structs/EnumerableMap.sol @openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol @openzeppelin/contracts-upgradeable/utils/PausableUpgradeable.sol @openzeppelin/contracts-upgradeable/access/Ownable2StepUpgradeable.sol @openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol solady/utils/ECDSA.sol solady/utils/SafeTransferLib.sol solady/utils/LibString.sol |
| /src/PhiFactory.sol | 1 | 454 | @openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol @openzeppelin/contracts-upgradeable/utils/PausableUpgradeable.sol @openzeppelin/contracts-upgradeable/access/Ownable2StepUpgradeable.sol @openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol solady/utils/ECDSA.sol solady/utils/LibClone.sol solady/utils/LibString.sol solady/utils/SafeTransferLib.sol solady/utils/LibZip.sol solady/utils/MerkleProofLib.sol |
| /src/abstract/Claimable.sol | 1 | 48 | |
| /src/abstract/CreatorRoyaltiesControl.sol | 1 | 39 | @openzeppelin/contracts/interfaces/IERC2981.sol |
| /src/abstract/RewardControl.sol | 1 | 83 | solady/utils/EIP712.sol solady/utils/SignatureCheckerLib.sol solady/utils/SafeTransferLib.sol |
| /src/art/PhiNFT1155.sol | 1 | 182 | @openzeppelin/contracts-upgradeable/token/ERC1155/ERC1155Upgradeable.sol @openzeppelin/contracts-upgradeable/token/ERC1155/extensions/ERC1155SupplyUpgradeable.sol @openzeppelin/contracts-upgradeable/utils/PausableUpgradeable.sol @openzeppelin/contracts-upgradeable/utils/ReentrancyGuardUpgradeable.sol @openzeppelin/contracts-upgradeable/access/Ownable2StepUpgradeable.sol solady/utils/SafeTransferLib.sol solady/utils/LibString.sol @openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol @openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol @openzeppelin/contracts/utils/introspection/IERC165.sol |
| /src/curve/BondingCurve.sol | 1 | 70 | @openzeppelin/contracts/access/Ownable2Step.sol @openzeppelin/contracts/access/Ownable.sol forge-std/console2.sol |
| /src/reward/CuratorRewardsDistributor.sol | 1 | 82 | solady/utils/SafeTransferLib.sol @openzeppelin/contracts/access/Ownable2Step.sol @openzeppelin/contracts/access/Ownable.sol forge-std/console2.sol |
| /src/reward/PhiRewards.sol | 1 | 81 | solady/utils/SafeTransferLib.sol @openzeppelin/contracts/access/Ownable2Step.sol @openzeppelin/contracts/access/Ownable.sol |
| Totals | 9 | 1546 |
See out_of_scope.txt
| File |
|---|
| ./script/Base.s.sol |
| ./script/Deploy.s.sol |
| ./script/DeployWoCred.s.sol |
| ./script/UpgradeCred.s.sol |
| ./src/interfaces/IBondingCurve.sol |
| ./src/interfaces/IContributeRewards.sol |
| ./src/interfaces/ICreatorRoyaltiesControl.sol |
| ./src/interfaces/ICred.sol |
| ./src/interfaces/ICuratorRewardsDistributor.sol |
| ./src/interfaces/IOwnable.sol |
| ./src/interfaces/IPhiFactory.sol |
| ./src/interfaces/IPhiNFT1155.sol |
| ./src/interfaces/IPhiNFT1155Ownable.sol |
| ./src/interfaces/IPhiRewards.sol |
| ./src/interfaces/IRewards.sol |
| ./src/lib/ContributeRewards.sol |
| ./src/lib/FixedPriceBondingCurve.sol |
| ./src/lib/Logo.sol |
| ./src/lib/MerkleProof.sol |
| ./test/Claimable.t.sol |
| ./test/ContributeRewards.t.sol |
| ./test/Cred.t.sol |
| ./test/CuratorRewardsDistributor.t.sol |
| ./test/DeployAndUpgradeTest.t.sol |
| ./test/PhiFactory.t.sol |
| ./test/RewardControl.t.sol |
| ./test/helpers/CredV2.sol |
| ./test/helpers/Settings.sol |
| ./test/helpers/TestUtils.sol |
| Totals: 29 |
Employees of PHI and employees' family members are ineligible to participate in this audit.
Code4rena's rules cannot be overridden by the contents of this README. In case of doubt, please check with C4 staff.