Overview
In the constantly evolving domain of blockchain technology and DeFi, the necessity to secure and maintain the integrity of smart contracts is more critical than ever. StarkDeFi, a pioneer in the DeFi sector, understood the importance of this challenge and engaged Blaize, a leader in blockchain solutions and security audits, for their expertise.
Recognizing the significant responsibility of safeguarding their platform, StarkDeFi collaborated with Blaize, who are celebrated for their prowess in smart contract auditing, to conduct a thorough examination of their systems. This collaboration aimed not only to validate the functionality of these systems but also to fortify them against potential security threats.
As part of their commitment to security, Blaize undertook a security audit of StarkDeFi’s Liquidity Locker feature, which allows users to lock in liquidity with StarkDeFi. This functionality serves a dual purpose: it enables users to earn rewards and fosters community trust within the expansive networks of StarkNet and Ethereum.
This audit is part of an ongoing relationship between StarkDeFi and Blaize, marked by previous milestones such as an initial smart contract security audit and the development of a backend solution for StarkDeFi’s decentralized exchange. This ongoing partnership underscores both companies’’ dedication to advancing security and functionality in the DeFi ecosystem.
Task
During the auditing process for this project, we checked StarkDeFi’s Liquidity Locker smart contracts for various vulnerabilities. The whole procedure is divided into the following stages:
1) Standard vulnerabilities checklists, including but not limited to:
- Access Management Hierarchy
- Math operations
- Transaction-ordering dependence
- Public interface constraints
- Denial-of-Service (DoS) attacks
- Hidden backdoors
- Storage issues (uninitialized, unused, etc) and incorrect local variable usage
- Correctness of functions’ parameters
- Upgradeability issues
and other potential Cairo vulnerabilities and attack vectors;
2) Business logic decompositions to find loopholes, deadlocks, hidden backdoors, incorrect math and calculations, malicious code injections, and other flow-related issues;
3) Review of dependencies, integrations, and 3rd parties, verified with appropriate integration tests;
4) Our own internal security checklists, additionally verified during the testing stage. The team had the main focus on verifying the correctness of implemented lock mechanics, the safety of stored assets, and created lock management.
