At Level K, we strive to help create a safe and secure ecosystem for both developers and users of blockchain technology. We use our knowledge and experience to audit decentralized applications and libraries as well as to build out open source libraries of our own.
Zeppelin asked us to audit OpenZeppelin 2.0, which falls in line with the goals mentioned above. Given the usage, sensitivity, timing, and sheer magnitude of the repository, we knew this was going to be intense but rewarding for all parties involved. Check out the final audit report here.
Findings
We are happy to report that the Zeppelin team did a great job on OpenZeppelin 2.0, keeping the repository well-maintained and thoroughly tested. Despite there being over 150 individual contributors to this codebase, we found that there was complete test coverage and that each contract was well-documented. The consistency of the contracts combined with well-written code and a thorough test suite allowed us to focus on the critical pieces of the codebase during the audit.
Each contract was redundantly checked for known exploits and unexpected behavior and was run through the smart contract analysis tool Mythril to help identify potentially vulnerable pieces of code. This is typical of our normal auditing process, however this audit brought its own unique challenges. Because the OpenZeppelin contracts are meant to be used and often times extended by developers with a range of abilities, we had to ensure the contracts were not only free of bugs but safe for developers to extend and use in different contexts. Our suggested changes to SafeERC20’s approval functionality are a great example of that. While there was nothing inherently wrong with the SafeERC20’s safeApprove() function in the commit we audited, our suggested guard rails guaranteed that even naive users would not fall victim to the well known double withdraw attack when using the SafeERC20 library.
We also found one critical issue in BreakInvariantBounty.sol. The claim() was susceptible to front-running by a malicious party which would lead to the loss of the researcher’s bounty. After independently coming up with the issue, we worked with the team, taking into consideration an existing PR, to decide on the best course of action. The Zeppelin team has removed the contract until a better solution can be identified.
Only one other high severity issue was found and explained, along with a recommendation on how to fix it. The vast majority of our recommendations were preventative. Mitigating the likelihood of a vulnerability being created allows developers to focus on writing application-specific code rather than worrying about the implementation of the underlying OpenZeppelin contracts. Our other suggestions in the audit ranged from gas optimizations and comment clarifications to recommended fixes of potentially exploitable code.
Conclusion
The Zeppelin team should be commended for their responsiveness throughout the entire process. They were on call during the entirety of the audit and answered any questions we threw at them. Many discussions regarding design decisions and expected contract outputs led to a deeper understanding of the code for everyone involved.
OpenZeppelin boasts over 10,000 weekly downloads and over 2,000 dependent projects with no signs of slowing down. This is a testament to the growth of not only OpenZeppelin but also the Ethereum ecosystem as a whole. It is our hope that our work here will help create a safer and more novice-friendly environment for the seemingly endless stream of new Solidity developers to jump in and get started with the OpenZeppelin tools.
We are glad that Zeppelin selected us to perform this audit, and we are happy that everything went smoothly. We look forward to seeing all the amazing contracts created by developers using this library.
If you are interested in a smart contract audit, please contact us at audits@levelk.io.
Note that our audit reflects the Level K analysis of the OpenZeppelin contracts based on currently known security patterns in Solidity and the EVM. We have not reviewed any other Zeppelin or OpenZeppelin products. Neither this post nor our audit report is investment advice and we do not endorse any token sale related to or created by this code. We do not guarantee that the code is unexploitable and assume no liability for any funds lost in these contracts.
