Overview
Jibrel is an open-source web3 development company. Jibrel provides tokenized financial assets on the Ethereum blockchain. This list includes such equities as currencies, bounds, and commodities of different kinds.
Task
The main task was to conduct a smart contract security audit and code review supported by Blaize engineers technical expertise. We have to provide two separate documents:
- the first document was concentrated on the recommendations for improving the code architecture and project structure due to our technical expertise in smart contracts development approaches;
- the second document represents the security audit report listing Tranche contract vulnerabilities and bugs according to the automated and manual testing results.
The technical task requires analysis with automatic tools together with a manual code review of the whole smart contracts’ set. In addition, we had to arrange a list of the main possible attacks and vulnerabilities the contract may suffer according to the project’s purposes.
The list of smart contract vulnerabilities that have been taken into account during the Jibrel code audit (the review includes them, but not limited to those):
- Unsafe type inference;
- Timestamp Dependence;
- Reentrancy;
- Implicit visibility level;
- Gas Limit and Loops;
- Transaction-Ordering Dependence;
- Unchecked external call;
- Unchecked math;
- DoS with Block Gas Limit;
- DoS with (unexpected) Throw;
- Byte array vulnerabilities;
- Malicious libraries;
- Style guide violation;
- ERC20 API violation;
- Uninitialized state/storage/local variables;
- Compile version not fixed.
The Blaize team of auditors always checks for novel types and variations of attacks additionally, in order to ensure that our client’s contracts are protected from all possible vulnerabilities. The whole list of possible attacks can be found in SWC Registry.
