Overview
Digital Original is a web3 platform that provides solutions for galleries and digital art markets. The solution provides the standard developed by the Digital Original team for private and public sales and auctions. In such a way, the platform ensures a seamless experience for collectors.
Modern NFT solution developed by the Digital Original team provides a new approach to the ownership of digital assets in the art space. Therefore, both collectors and galleries receive the speculation-proofed solution, new digitalization process, and security backed by the onchain layer. Blaize Security team is happy to support the security side of the platform via the smart contracts audit.
Task
During the auditing process for this project, we checked Digital Original smart contracts for various vulnerabilities. The whole procedure is divided into the following stages:
1) Standard vulnerabilities checklists, including but not limited to:
- Storage structure and data modification flow
- Access control structure, roles existing in the system
- Public interface and restrictions based on the roles system
- Order-dependency and time-dependency of operations
- Validation of function parameters, inputs validation
- Asset Security (backdoors connected to underlying assets)
- Incorrect minting, initial supply or other conditions for assets issuance
- Denial-of-Service (DoS) attacks
- General code structure checks and correspondence to best practices
- Upgradeability issues
and others potential Solidity vulnerabilities and attack vectors;
2) Business logic decompositions to find loopholes, deadlocks, hidden backdoors, incorrect math and calculations, malicious code injections, and other flow-related issues;
3) Review of dependencies, integrations, and 3rd parties, verified with appropriate integration tests;
4) Our internal security checklists were verified during the testing stage. The team focused on the review of the funds’ flow (both stablecoins and NFTs), on the correspondence of the auction flow and sell/purchase process, and on the validation of the solution’s parameters. The team deeply analyzed the business logic of the platform, thoroughly testing each stage of the auction.
