СoW Protocol: ComposableCoW & ExtensibleFallbackHandler audit summary

CoW Swap is the first trading interface built on top of CoW Protocol. CoW Swap is a Meta DEX aggregator that allows you to buy and sell tokens using gasless orders that are settled peer-to-peer among users, or into any on-chain liquidity source while providing protection from MEV.

Cow Protocol engaged Ackee Blockchain to perform a security review of the ComposableCoW & ExtensibleFallbackHandler with a total time donation of 8 engineering days in a period between July 18 and July 28, 2023.

METHODOLOGY

We began our review by using static analysis tools, namely . We then took a deep dive into the logic of the contracts. For testing, we have involved testing framework. During the review, we paid special attention to:

• replay attacks
• signature validation
• payload manipulation
• detecting possible reentrancies
• ensuring the arithmetic of the system is correct
• the correctness of encoding/decoding data
• ERC-1271 compliance
• looking for common issues such as data validation.

SCOPE

The audit has been performed on the following scope:

The review was done on the given commits Revision 1.0 :

Revision 1.2 was done on the ComposableCow commit bd2634d , the ExtensibleFallbackHandler commit was not changed since Revision 1.1.

FINDINGS

Critical severity

C1: StopLoss arithmetic mismatches

High severity

No high severity issues were found.

Medium severity

M1: Oracle data validation

Low severity

L1: Constructor data validation

Warning severity

W1: GPv2Order data tampering

W2: Revert conditions inconsistency

W3: Vulnerable MerkleProof library

W4: GoodAfterTime order is missing the receiver address

Informational severity

I1: Unnecessary SafeMath

I2: Missing cabinet cleanup

I3: Errors in the documentation

I4: TradeAboveThreshold order receiver naming

I5: Inconsistent error

I6: Commented-out code

I7: Inconsistent naming

CONCLUSION

Our review resulted in 14 findings, ranging from Informational to Critical severity. The critical issue C1: StopLoss arithmetic mismatches has been fixed according to our recommendations, and the decimals handling in the M1: Oracle data validation issue were implemented properly (Revision 1.2).

Other issues are low-severity data validations, warnings and informational findings, which are recommendations rather than issues. The overall code quality and architecture are professional. The whole project is well documented and contains in-code NatSpec documentation and detailed comments.

Ackee Blockchain recommendes CoW Protocol:

• to add oracle data validations
• to be aware of zero-address validations
• to unify syntax and naming
• to address all reported issues.

As of Revision 1.2, L1: Constructor data validation issue was acknowledged, all other issues were fixed.

Ackee Blockchain’s full COW Protocol audit report with a more detailed description of all findings and recommendations can be found here.

We were delighted to audit Cow Protocol and look forward to working with them again.

Originally published at https://ackeeblockchain.com on December 15, 2023.