## About DeFi Kingdoms

[DeFi Kingdoms](https://defikingdoms.com/) is a blockchain-based strategy game that combines decentralised finance (DeFi) and non-fungible tokens (NFTs) with gaming. Players can explore a virtual world, build and manage their kingdoms, and participate in battles with other players.

The game operates on the DFKChain and Klaytn networks and uses the native token "JEWEL" as its currency. Players can earn JEWEL tokens by completing tasks, participating in battles, and staking their assets in liquidity pools.

DeFi Kingdoms also incorporates NFTs, which are unique digital assets that represent ownership of in-game items, such as weapons, armour, and characters. These [NFTs](https://www.cyberscope.io/blog/what-is-an-nft-what-are-the-5-most-expensive-nfts-ever-sold) can be bought and sold on decentralized marketplaces.

DeFi Kingdoms aims to create a fun and engaging gaming experience while also providing users with the benefits of DeFi and NFTs, such as the ability to earn passive income and own valuable digital assets. Their products are used by thousands of users daily and they are releasing new features every few weeks.

## Cyberscope x DeFi Kingdoms

DeFi Kingdoms was searching for an audit firm that can adapt to their development speed and requirements. 

 The main requirements were:

* **Speed:** DeFi Kingdoms are constantly improving their smart contracts and shipping new features. They were looking to work with an audit firm that can deliver audit assessments that matches their development speed.
* **Quality:** While speed was of the essence to the engineering team, they didn’t want to compromise quality, so they were looking for a reputable team that could take on this challenge.
* **Performance:** Serving thousands of users daily, DeFi Kingdoms team is always looking for ways to improve performance. They wanted the auditors to give attention to any optimisations that can happen in their contracts.

The collaboration started with the first audit assessment, which was the Crystal token. DeFi Kingdoms was initially impressed by the assessment results. Cyberscope delivered a ​​smart contract audit report that achieved a combination of speed and quality to ensure that the audit is thorough and completed within a reasonable timeframe. 

Therefore, Cyberscope was established as a significant audit partner of DeFi Kingdoms. The Auction House Ecosystem was the next big project out of many more to come.

## The Crystal Token Audit Report

The Crystal Token is one of the tokens around the DeFi Kingdoms Ecosystem. In [Crystalvale](https://defikingdoms.com/crystalvale), Crystal serves as the primary token of value, providing more utility than a typical cryptocurrency. 

This token can be used to acquire and produce Hero NFTs, exchanged on the in-game DEX, combined for liquidity, and other in-game activities.

The audit assessment had many aspects of the contract and the business logic to evaluate. Some of them were:

* To ensure that the token works as expected in terms of a standard tradable token.
* To make sure that the contract roles are clearly defined.
* To establish that the additional features do not contain any vulnerabilities. 

The additional features of the Crystal token are the mint functionality and a lockers mechanism. Among some minor findings, the audit assessment found one critical and one medium severity finding. 

The critical finding was taking place in the lockers feature. The contract had an inconsistency in how it handled the date period. This issue could produce a huge impact on the additional functionality and the contracts that interact with it. The audit report contained a detailed explanation of the issue as well as information on how it can be reproduced. It also assisted the developers with recommendations for potential fixes. 

The medium severity finding evolved into an inconsistency issue that could be produced from an incorrect contract configuration. If an authorized user performed a sequence of some specific actions in the contract configuration, then the locked tokens could remain locked forever inside the contract. Following the same pattern as the critical finding, the audit report helped the reader with a detailed description and recommendation. DeFi Kingdoms’ team was more than happy with the outcome of the audit and impressed with the delivery speed of the report and the vulnerabilities that were uncovered.

Read the [full report here](https://github.com/cyberscope-io/audits/blob/main/defi-kingdoms/token.pdf).[](https://github.com/cyberscope-io/audits/blob/main/defi-kingdoms/token.pdf)

## A Longterm Collaboration

DeFi Kingdoms was impressed with the quality and speed of Cyberscope’s audit. As a token of their gratitude, DeFi Kingdoms added Cyberscope as an NPC (non-player character) inside their game. Thousand of players can learn more about Cyberscope while they are [playing their favourite game](https://game.defikingdoms.com/castle), by talking to the 'Envoy' NPC and clicking on the 'View Apps' button.

![Cyberscope featured in DeFi Kingdoms game](https://firebasestorage.googleapis.com/v0/b/cyberscope-90197.appspot.com/o/blog%2Fbucket%2F1706188998974-2024-01-25_15h22_01.png?alt=media)



## Final Thoughts

The success story of the collaboration between the DeFi Kingdoms and Cyberscope serves as yet another testimony of the quality and speed of their [smart contract audits](https://www.cyberscope.io/blog/smart-contract-audits-a-complete-guide). When DeFi Kingdoms was searching for a solution that could deal with their demanding requirements, Cyberscope was there to cover all their needs. DeFi Kingdoms chose an experienced audit partner that assists them in the entire production cycle. Cyberscope is helping DeFi Kingdoms to deliver production-ready features cleared of vulnerabilities and performance optimized. 

You can keep track of the ongoing partnership and the full reports here: <https://www.cyberscope.io/audits/defi-kingdoms>

Eliminating vulnerabilities in the crypto game industry

DeFi Kingdom and Cyberscope -  Case Study

## The OGN Ecosystem

[Origin Protocol](https://www.originprotocol.com/) is a web3 protocol aiming to bring non-fungible tokens (NFTs) and decentralized finance (DeFi) to the masses.

The OGN team has a huge experience in building blockchain products. Origin Protocol is a decentralized platform that aims to enable the creation of peer-to-peer (P2P) marketplaces. The platform is built on the Ethereum blockchain and utilizes smart contracts to facilitate transactions and the creation of decentralized applications (dApps). The native token of the platform is called OGN (Origin Protocol token), which is used to incentivize participation in the network and to pay for various services within the Origin ecosystem. OGN can also be used to vote on governance decisions and access certain features on the platform.

OGN token market cap valuation is [more than 50 million](https://coinmarketcap.com/el/currencies/origin-protocol/markets/), covering more than 5 million in trading volume per day. It is exchanged in more than 70 exchanges including Binance, Coinbase, KuCoin, and Kraken.

## Numbers and Challenges

OGN security is an essential and integral part of the ecosystem. They have introduced dozens of decentralized applications and features. Hundreds of different developers have implemented these applications over a long time period. The following numbers are some of the statistics from the official [Origin Protocol repository](https://github.com/OriginProtocol/origin-dollar).

* 3,121 commits
* 750 Pull requests
* 500 thousand lines of code

![Origin Protocol Code Contribution Timeline](https://firebasestorage.googleapis.com/v0/b/cyberscope-90197.appspot.com/o/blog%2Forigin-protocol-ogn-cyberscope-audit-case-study%2F1.png?alt=media "20")

The OGN products are used by thousands of users in the decentralized world. The OGN popularity combined with the code base diversity poses a challenging cybersecurity task.

Cyberscope audit experts were chosen in order to tackle this challenging task. In the initial collaboration between OGN and Cyberscope, the staking contract was selected to be audited.

An audit of a staking contract is important because it can help to ensure that the contract is functioning as intended and that it is secure and reliable. A staking [smart contract audit](https://www.cyberscope.io/blog/smart-contract-audits-a-complete-guide) can help identify any contract issues, such as bugs or vulnerabilities, and provide recommendations on how to fix those issues. This can help to promote confidence and trust in the staking process and the overall security of the ecosystem.

You can find OGN’s staking contract in the [official repository](https://github.com/OriginProtocol/origin-dollar/blob/master/contracts/contracts/staking/SingleAssetStaking.sol).

![Cyberscope Staking Contract Audit](https://firebasestorage.googleapis.com/v0/b/cyberscope-90197.appspot.com/o/blog%2Forigin-protocol-ogn-cyberscope-audit-case-study%2F2.png?alt=media)

## Staking Contract Audit

One of the main responsibilities of Cyberscope’s auditors was to ensure that the staking is reliable, secure, and functioning as intended.

Getting a smart contract audit for any staking contract is a crucial part of every project. An independent and objective assessment of a smart contract, by a reputable third-party cybersecurity firm like Cyberscope, can give the investors of the project confidence and assurance that the staking will work as intended.

Immediately after getting in touch with OGN’s team, Cyberscope’s auditors got to work. Initially, the audit process was split into separate steps. Each step was an essential part of the final audit report.

**Step 1. Reviewing the code**

OGN’s staking contract was assigned to two senior solidity auditors to review the code of the smart contract and to ensure that it is well-written, follows best practices, and is free of errors and vulnerabilities. Since this is one of the most critical parts of the audit, Cyberscope is always using two auditors to make sure that they will peer review each other’s work and cover as many issues as possible.

**Step 2. Testing the contract**

The auditors run numerous tests on the smart contract to ensure that it is functioning as intended and that it can handle all possible scenarios correctly. The contract was deployed in a local environment so it can be called by the auditors.

**Step 3. Evaluating the contract's security**

The auditors assessed the security of the smart contract to ensure that it is resistant to attacks and that it has appropriate safeguards in place to protect against unauthorized access.

**Step 4. Providing Recommendations**

When the auditors identified issues with the smart contract, they provided recommendations for how to address those issues and make the contract more reliable and secure.

![OGN Staking Contract Features Cyberscope Breakdown](https://firebasestorage.googleapis.com/v0/b/cyberscope-90197.appspot.com/o/blog%2Forigin-protocol-ogn-cyberscope-audit-case-study%2F3.png?alt=media)

## Staking Contract Features Breakdown

The cyberscope team investigated thoroughly the basic functionality that the staking contract provides.

* **Stake**, any user has the ability to stake any amount of tokens for a specific duration and rate.
* **StakeWithSender**, the contract of the staking token has the ability to stake any amount of tokens for a specific duration and rate.
* **AirDroppedStake**, some users that are picked by the staking contract admins have the ability to stake tokens for a predefined amount, duration, and rate.

The audit assessment report mentions all the logical entities, the permissions that are required for each entity, and their dependencies.

Each feature was checked in combination with the rates and duration that the business logic of the staking contract provides. One of the most tricky parts of a staking contract is the balance. The contract’s balance is a combination of different variations:

* The healthy state of [Annual Percentage Yield (APY) and Annual Percentage Rate (APR)](https://www.cyberscope.io/blog/apy-vs-apr-what-are-the-differences).
* The contract reserves.
* The emergency withdraws.
* The rewards claim functionality in edge cases like the beginning and the end of the staking period.

## Main Assessment

In the main assessment delivery, the Cyberscope team reported 9 findings varying between potential overflows, transfer amount inconsistency, and performance optimizations. The audit also commented on the business logic approaches, the issues that may be produced, and the possible recommendations that could be applied. For instance, the Merkle proof mechanism was picked as one of the alternatives in order to add the airdrop winners in the smart contract efficiently.

OGN is an open-source repository with many contributors and the audit findings require some time to be processed and resolved. Some of the findings were added by the contributors in the public repository tickets so they can also be handled by the community.

Some of the issues: <https://github.com/OriginProtocol/origin-dollar/issues/1194>

## Never-Ending Roadmap

OGN has an ever-evolving roadmap with many new features and decentralized applications under development. The more code is added, the more maintenance and security are required. When the code base is increased linearly to an enormous code base like OGN, then the complexity and the vulnerabilities are increased exponentially.

The Cyberscope team has committed to helping the OGN ecosystem to keep growing. It is not a waterfall security assessment, but a never-ending circle. The success of the OGN project is also a success for the Cyberscope team. That’s the reason that the OGN foundation chose to work with one of the experts in the cybersecurity industry.

R﻿ead the [full report here](https://github.com/OriginProtocol/security/blob/master/audits/community/CyberScope%20-%20OGN%20Staking%20-%20Dec%202022.pdf). [](https://github.com/OriginProtocol/security/tree/master/audits/community)

Origin Protocol (OGN) x Cyberscope Audit - Case Study

## About ApeSwap

[ApeSwap](https://apeswap.finance/) is a decentralized exchange (DEX) built on the Binance Smart Chain (BSC). It allows users to buy and sell tokens using BSC's faster and cheaper transaction fees. ApeSwap provides a platform that offers a comprehensive suite of tools. These tools give users the ability to explore and engage with features that are related to wealth-building. ApeSwap started as a PancakeSwap fork but quickly evolved into a huge ecosystem of tools and solutions. Some of the tools are Swap, Liquidity Generation, Stake, Lend and borrow, and IDO.

According to [CoinMarketCap](https://coinmarketcap.com/exchanges/apeswap/) stats, ApeSwap has listed thousands of token pairs. The listed tokens produce more than 20 million daily trading volume. It is currently counting more than 50 million worth of tokens locked. These numbers are making ApeSwap one of the most popular Decentralized platforms in the BSC network.

## DEX Contracts

ApeSwap operates as a decentralized exchange (DEX). That means that it is a cryptocurrency exchange that operates without a central authority. It allows users to trade cryptocurrencies directly with one another, rather than going through a central intermediary such as a traditional exchange.

In a decentralized exchange, the most common type of trade is called a “pair contract”. This is a smart contract that allows users to trade one cryptocurrency for another. The core functionality of ApeSwap is the pair generators and the swap contracts. The pair generators consist of two files. The pair factory contract and the pair instances. Cyberscope’s audit security assessment scope was to check and review the pair generator functionality.

Pair contracts are generally created by the DEX and are stored on a blockchain. They contain the rules for the trade, such as the exchange rate and the amount of cryptocurrency that can be traded. When a user wants to make a trade, they interact with the pair contract by sending the appropriate amount of cryptocurrency to the contract. The contract then executes the trade and sends the corresponding amount of the other cryptocurrency to the user.

ApeSwap contracts are open source and publicly available to any user. Cyberscope team was assigned to audit the swap-core repository that implements the pair contracts.

<https://github.com/ApeSwapFinance/apeswap-swap-core>

![ApeSwap Decentralized Exchange](https://firebasestorage.googleapis.com/v0/b/cyberscope-90197.appspot.com/o/blog%2Fapeswap-cybercope-case-study%2F1.png?alt=media)

## The Challenge

Auditing a Pair contract is a challenging task by definition. When it comes to ApeSwap, the difficulty is increased dramatically since it is one of the most popular decentralized exchanges (DEX) in the Binance Smart Chain (BSC) network. Thousands of users are using the application and the underlying Pair contracts daily.

The pair smart contracts are deployed on the blockchain, which means that they are immutable and cannot be changed once they are deployed. This can make it difficult to fix errors or vulnerabilities that are discovered during the audit process.

Auditing a DEX pair contract like ApeSwap’s pairs requires a high level of expertise in both smart contract development and blockchain technology. It is important for the audit to be thorough and to identify any potential issues or vulnerabilities that could impact the security and reliability of the contract.

![ApeSwap Cyberscope Auditing Approach](https://firebasestorage.googleapis.com/v0/b/cyberscope-90197.appspot.com/o/blog%2Fapeswap-cybercope-case-study%2F2.png?alt=media)

## Auditing Approach

The audit assessment was broken down [into smaller steps](https://www.cyberscope.io/blog/smart-contract-audits-a-complete-guide) in order to make the process clear and error-proof. A team of Cyberscope security experts proceeded with the audit.

Initially, the auditors generated assisting material from the static analysis. This involves the execution of internal tools that have been implemented to assist the auditors. Some of the material that is produced includes dependency graphs, functions visibility, access roles, and findings that can be discovered from the static analysis.

The implementation of pair contracts had become well-known from the Ethereum Uniswap DEX. Later it was adopted by [PancakeSwap](https://pancakeswap.finance/) in the BSC network. The legacy implementations have created a bibliography of documents and pre-existing audit assessments. Cyberscope auditors are always up to date with the latest technologies, all the blockchain patterns, implementations, and known vulnerabilities. Using their expertise, in the second step of the assessment, the auditors cross-checked all the latest patterns and best practices that could be used to assist in auditing the swap-core repository of ApeSwap.

Then, the auditors peer-reviewed each other findings and suggestions in order to correlate the findings. The correlated findings were then merged to produce the final audit delivery. \
\
R﻿ead the [full report here](https://github.com/cyberscope-io/audits/blob/main/apeswap/audit.pdf).[](https://github.com/cyberscope-io/audits/blob/main/apeswap/audit.pdf)

## Summary

Auditing a decentralized exchange (DEX) is important for several reasons. First and foremost, an audit helps to ensure the security of the exchange by identifying any vulnerabilities that may exist. This is especially important for ApeSwap, which operates on a decentralized platform, as any security vulnerabilities could potentially be exploited by malicious actors.

Additionally, an audit can help to increase the transparency and trustworthiness of the exchange. By conducting an independent review of the exchange's code and operations, users can have greater confidence that the exchange is operating in a fair and transparent manner. Auditing the ApeSwap helped to protect users' assets, ensure the integrity of the exchange, and build trust in the platform.

Cyberscope experts are always ready to consult and audit a smart contract by carefully reviewing the code to ensure that it is free of vulnerabilities and follows industry best practices. They can also test the contract by executing it in a simulated environment and verifying that it behaves as expected. Additionally, they can review the contract's deployment and management processes to ensure that it is secure.

If you want to learn more about our methodology feel free to contact us at: [contact@cyberscope.io](contact@cyberscope.io).

Securing the trades of the Decentralized Exchange world.

ApeSwap x Cybercope - Case Study

## About Quarashi

[Quarashi’s](https://quarashi.network/) mission is to connect blockchain adopters worldwide. It has created a variety of features and applications in one single platform. The Quarashi ecosystem consists of Bridge, Vesting Claim, Staking, Multi Sender, and Markets Overview. It has also created a crypto wallet that allows users to secure, manage, and exchange cryptocurrencies. The wallet is available on [Google Play](https://play.google.com/store/apps/details?id=com.ibt.quarashi&pli=1). The Quarashi token is currently exchanged in many top-tier exchanges like MEXC and WhiteBIT.

## The beginning

Quarashi was searching for an experienced audit firm to deal with all the different contracts, requirements, and networks. The collaboration with Cyberscope started by auditing the QUA token in the BSC network. Then, it proceeded with the other contracts across the different networks.

Cyberscope also helped the Quarashi team by increasing its reputation and bringing them new investors. This happened as a result of the KYC services that Quarashi used. As part of the KYC process, Cyberscope confirms the real identities of the project team. This way the Quarashi team provided an extra security layer for their investors.

You can find [Quarashi’s KYC certificate here](https://github.com/coinscope-co/kyc/blob/main/qua/kyc.png). [](https://github.com/coinscope-co/kyc/blob/main/qua/kyc.png)

![Quarashi Network Auditing Approach Cyberscope](https://firebasestorage.googleapis.com/v0/b/cyberscope-90197.appspot.com/o/blog%2Fquarashi-cybercope-audit-and-consulting-case-study%2F1.png?alt=media)

## Smart Contract Audit of Different Applications

**ERC-20**

The QUA token that is deployed in the Ethereum network implements the standard ERC20 interface enriched with a vested functionality. Cyberscope team investigated all the aspects of the feature and all the resulting edge cases. More information about the audit report can be found in the official repository.

R﻿ead the [initial report here](https://github.com/coinscope-co/audits/blob/main/qua/v1/audit.pdf).[](https://github.com/coinscope-co/audits/blob/main/qua/v1/audit.pdf)

**BEP-20**

The Quarashi ecosystem quickly expanded to the BSC network. They introduced their token, for which they were planning to create an IDO. Cyberscope helped the team to move the Ethereum token features to the BSC network. The requirement was to keep the same functionality that the Ethereum token has, but adjusted to the BSC network. 

Read the [full report here](https://github.com/coinscope-co/audits/blob/main/qua/audit.pdf).[](https://github.com/coinscope-co/audits/blob/main/qua/audit.pdf)

**Bridge**

One of the most important parts of the transition from Ethereum to BSC was the [bridge functionality](https://www.cyberscope.io/blog/what-is-a-crypto-bridge). This functionality allowed users to convert their tokens from one network to the other and vice versa. Bridges are one of the [most vulnerable parts](https://www.forbes.com/sites/mariagraciasantillanalinares/2022/08/18/over-2-billion-stolen-this-year-in-blockchain-bridge-hacks-expose-defis-achilles-heel/) of the blockchain world since it is a complicated mechanism. This complexity is produced by the many sections that may be vulnerable in a Bridge application. Cyberscope’s team paid attention to various aspects like the way that the contracts are handling the signatures, the way that they validate the funds that are going to be transferred, and potential ways that an attacker could bypass the checks and the off-chain communication. Cyberscope and Quarashi teams had a great collaboration in order to address all the findings that came to the surface of the audit report.

R﻿ead the [swap report here](https://github.com/coinscope-co/audits/blob/main/qua/swap.pdf).[](https://github.com/coinscope-co/audits/blob/main/qua/swap.pdf)

**Vesting**

Quarashi developers have a huge experience in building large-scale applications. The requirement for a robust audit report is not only helping the team to identify all the potential vulnerabilities, but also validating if the contract implements the expected business logic. This task requires iterations with both the executives and the development team. Cyberscope helped the Quarashi team to validate the proper operation of their vesting contract. The audit report mentions all the functionality that the vesting contract provides. The vest tiers, the initial lock-up period, the progressive unlocks, and the applicable users that have allocated vested tokens.

R﻿ead the [vesting report here](https://github.com/coinscope-co/audits/blob/main/qua/vesting/vesting.pdf).

**Staking ERC-20/BEP-20**

Contracts with functionality similar to Stake and Bridge are one of the most targeted contracts for attacks. These kinds of contracts accumulate large amounts of tokens and most of the functions are publicly available to the users. This creates an attractive target for malicious users. Cyberscope [has helped many firms](https://www.cyberscope.io/blog/origin-protocol-ogn-cyberscope-audit-case-study) to secure infrastructures and features like this one. One of these firms is the Quarashi network.

R﻿ead the [ETH staking report here](https://github.com/coinscope-co/audits/blob/main/qua/stakingeth.pdf).

R﻿ead the [BSC staking report here](https://github.com/coinscope-co/audits/blob/main/qua/stakingbsc.pdf).

The results of the audit assessments were presented in reports, which outline the issues that were identified and provide recommendations for how to fix them. These reports are an important tool for the developers of smart contracts, as they help them to improve the quality and reliability of their contracts. They are also an important resource for the investors, as they provide assurance that the contract has been thoroughly tested and reviewed and that it is safe and reliable to use. Finally, the audit reports provide safety for the executives and stakeholders of the project that the contract is operating according to the business logic that they decided.

> Thank you all audits will come to you. We will audit everything from now on.

*Alexandru Petre, Founder & Project Lead*

![Cybersscope Cybersecurity and Web3.0 Consultancy](https://firebasestorage.googleapis.com/v0/b/cyberscope-90197.appspot.com/o/blog%2Fquarashi-cybercope-audit-and-consulting-case-study%2F2.png?alt=media)

## Cybersecurity & Web3.0 Consultancy

The collaboration between Cyberscope and Quarashi did not stop within the boundaries of the audit report. Cyberscope assisted and consulted the Quarashi team on many topics like liquidity pool mounting and tracing of unexpected transactions. Cyberscope also helped the Quarashi team to properly initialize and finalize their IDO with the configuration of the contract's parameters. Furthermore, they helped them to address various edge cases of the vesting contract. Finally, Cyberscope played a crucial part in assisting them to resolve common issues like the exact timestamp that the amounts will be released and the validation of the vesting schedule.

Audit assessments of smart contracts are important because they help to ensure the correctness, security, and efficiency of the contract. An audit assessment involves a thorough review of the smart contract code by a team of experts. These experts will analyze the code to identify any potential vulnerabilities or bugs that could affect the contract's performance. They will also review the contract to ensure that it is efficient and optimized for execution on the blockchain. In Cyberscope this task is the number one priority. Since the success of a project is our success.

The most important part of Cyberscope's work is to communicate their findings and recommendations clearly to the relevant stakeholders and to work with the development team to address any issues that are identified.

## Summary

The lack of cybersecurity in smart contracts can lead to potential losses in several ways. First, if a smart contract has vulnerabilities or is not properly secured, it may be susceptible to attack by hackers. Hackers may be able to exploit these vulnerabilities to steal funds or sensitive information that is stored within the contract. This can result in significant financial loss for the users of the contract.

In addition to financial loss, the lack of cybersecurity in smart contracts can also lead to reputational damage. If a smart contract is hacked or otherwise compromised, it can create a lack of trust in the contract and the parties involved. This can make it difficult for the parties to use the contract in the future, or to engage in similar types of transactions.

Furthermore, the lack of cybersecurity in smart contracts can also have broader implications for the use of blockchain technology. If smart contracts are perceived as being unreliable or insecure, it may discourage the wider adoption of blockchain technology and its potential benefits.

It is important for smart contracts to be properly secured and tested to ensure that they are safe and reliable for use. This includes conducting regular audit assessments and implementing robust cybersecurity measures to protect against potential attacks.

In Cyberscope we take security principles extremely seriously. As we did with the Quarashi ecosystem, we can help any project by securing its infrastructure and by providing any kind of cybersecurity or Web3.0 consultancy. If you want to learn more, feel free to send us a message at: [contact@cyberscope.io](contact@cyberscope.io).

A comprehensive audit assessment across multiple networks, including staking, vesting, and bridging applications.

Quarashi x Cybercope Audit and Consulting Case Study

## About Tangible Store

[​​Tangible Store](https://www.tangible.store/) is a TNFT (Tangible Non-Fungible Token) marketplace. Their mission is to convert real-world assets into NFTs. These NFTs can be redeemed for the physical item at any time.

They are aiming to connect the cryptocurrency world with physical goods via well-known suppliers. The way the store works is quite simple. Right after the purchase, a Tangible non-fungible token is minted in the issuer’s wallet. This TNFT represents the corresponding physical item. Then this item is delivered to the Tangible’s storage facilities.

At any time, the owner of the TNFT can process the physical item. The possible actions are:

* Redeem it for the physical item
* Transfer it to another wallet
* Sell it on Tangible’s marketplace

Tangible Store has also its own stablecoin coin called USDR. It has been introduced to cover the ecosystem requirements. Real USD is backed by real-world assets, the real estate in the treasury. New Real USD can only be created when money flows in and is converted into real estate. This makes Real USD a safe store of value.

## Cyberscope x Tangible Store

The Tangible Store was introduced to Cyberscope through the Polygon DAO ecosystem. Cyberscope is one of the [trusted partners of Polygon](https://www.cyberscope.io/blog/cyberscope-becomes-an-audit-voucher-partner-of-the-polygon-village-program), offering its smart contract audit services to Polygon projects and helping them with their cybersecurity needs.

The Tangible Store was looking for an experienced audit team in marketplaces and stablecoins and Polygon DAO introduced them to Cyberscope which has over 1,000 projects in its portfolio ranging from simple tokens to complex Dapps.

![Cyberscope Polygon Dao Village Program](https://firebasestorage.googleapis.com/v0/b/cyberscope-90197.appspot.com/o/blog%2Fcyberscope-and-tangible-store-audit-case-study%2F1.png?alt=media)

## Tangible Store Challenges

Tangible Store has an extensive codebase that consists of numerous smart contracts. The code base at the point of contact with Cyberscope had 48 solidity files.

After the initial introduction, Cyberscope engineers started working closely with Tangible Store from day one. The Cyberscope team's initial target was to identify how all the entities are connected with each other and investigate the expected business logic for each entity. The auditors went through the documentation of Tangible Store, workflows, and graphs and kept regular contact with Tangible Store’s engineers.

As mentioned earlier the Tangible Store has introduced its own stablecoin to the marketplace. USDR is a stablecoin with a different approach from an ordinary stablecoin. The total supply reserves should guarantee that are equal to the underlying items’ values. For instance, if a real estate asset is worth $500,000 then the corresponding USDR supply should be 500,000 tokens.

This concept presents various challenges that need to be taken into consideration by the auditors. For example, how the inflation and the assets’ worth will be reflected in the USDT supply. Cyberscope engineers mapped out all the different use cases and created customized unit tests to make sure the smart contracts cover all the edge cases of the business logic.

## Methodology and Approach

As a first step, Cyberscope’s auditors carefully read and reviewed all the documentation provided by the Tangible team. Then the auditors scheduled a review meeting with Tangible’s engineers to make sure they have a thorough understanding of how their ecosystem works.

Sequentially, they created various assisting materials including graphs, dependencies flows, functions tables, etc. to visualize and understand how the various smart contracts are connected. Then, they proceeded with manual line-by-line code checks starting from the main entities and components. Each auditor assigned to the project created his own [audit report](https://www.cyberscope.io/blog/smart-contract-audits-a-complete-guide) with findings. The reports were peer-reviewed and the cyberscope team combined and correlated each auditor’s findings in order to extract the final report.

![Cyberscope Tangible Store Audit Methodology](https://firebasestorage.googleapis.com/v0/b/cyberscope-90197.appspot.com/o/blog%2Fcyberscope-and-tangible-store-audit-case-study%2F2.png?alt=media)

## Findings

The initial audit report consisted of an extensive 70-page report with 20 findings and comments about the micro-architecture. Some of the findings were essential to be considered by the Tangible store team for the proper operation of their ecosystem. Each finding also provided suggestions and recommendations about potential solutions. The comments included but were not limited to:

1. Concerns and considerations about the Decentralized Autonomous Organization (DAO) nature of the project.
2. Decimal conversion between different tokens.
3. Roles access architecture.

You can find the [initial full report here](https://github.com/cyberscope-io/audits/blob/main/tngbl/audit.pdf).

![Cyberscope Tangible Store Findings Analysis](https://firebasestorage.googleapis.com/v0/b/cyberscope-90197.appspot.com/o/blog%2Fcyberscope-and-tangible-store-audit-case-study%2F3.png?alt=media)

## Contract Diagnostics

| Severity          | Code  | Title                                      |
| ----------------- | ----- | ------------------------------------------ |
| Medium            | AFI   | Affiliate Token Issue                      |
| Medium            | STI   | Staking Token Issue                        |
| Minor/Informative | DMI   | Defractionalize Manipulation Issue         |
| Minor/Informative | TBI   | Token Balance Inconsistency                |
| Minor/Informative | PRD   | Pair Reserves Diversion                    |
| Minor/Informative | REE   | Redundant Event Emission                   |
| Minor/Informative | TAZFA | Transferred Amount Zero Fees Assumption    |
| Minor/Informative | AIC   | Arguments Inconsistency                    |
| Minor/Informative | ELFM  | Exceeds Fees Limit                         |
| Minor/Informative | DSM   | Decimal Scale Missconsern                  |
| Minor/Informative | PIL   | Potential Infinite Loop                    |
| Minor/Informative | STC   | Succeed Transfer Check                     |
| Minor/Informative | CO    | Code Optimization                          |
| Minor/Informative | L04   | Conformance to Solidity Naming Conventions |
| Minor/Informative | L09   | Dead Code Elimination                      |
| Minor/Informative | L11   | Unnecessary Boolean equality               |
| Minor/Informative | L12   | Using Variables before Declaration         |
| Minor/Informative | L13   | Divide before Multiply Operation           |
| Minor/Informative | L14   | Uninitialized Variables in Local Scope     |
| Minor/Informative | L15   | Local Scope Variable Shadowing             |

## Revisions

The audit report was just the first step in the audit process of Tangible Store’s smart contracts. The Cyberscope team is always working closely with the client in order to consult them about the findings and potential fixes or improvements they can implement. The Tangible team were quick to take action on Cyberscope’s recommendations and they either fixed or replied to all the initial findings.

Revision in an audit report is the process of reviewing and re-evaluating the audit procedures and findings as necessary in order to reach a final conclusion. This may involve repeating certain procedures and/or gathering additional evidence if the auditor's initial findings are inconclusive or if there are discrepancies that need to be resolved.

You can find the final audit report of Tangible Store in the Cyberscope audits repository.\
\
R﻿ead the [full report here](https://github.com/cyberscope-io/audits/blob/main/tngbl/audit.pdf).[](https://github.com/cyberscope-io/audits/blob/main/tngbl/audit.pdf)

## A Longterm Collaboration

The Tangible Store was impressed by Cyberscope’s team professionalism, attention to detail and delivery speed and is looking forward to keeping working with them in the long run. They are a fast-growing organization that keeps implementing new smart contracts and improving its current infrastructure.

Cyberscope is continuously tracking all the changes made by the team and provides meaningful feedback on how they can keep up with the latest cybersecurity standards.

## Final Thoughts

With cryptocurrency scams reaching all-time highs, it is imperative for emerging projects like the Tangible Store to make sure they select the right cybersecurity partner and audit their smart contracts.​ Cyberscope’s team audit report included essential findings that helped Tangible Store’s ecosystem to improve its security and business logic and will deem essential in the scalability of the project.

And this is just the beginning. Cyberscope’s relationship with its clients goes beyond the smart contract audits to make sure they have a cybersecurity partner they can trust and rely on.

Both parties will continue to work together in order to secure and improve the Tangible Store’s ecosystem.

A case study covering a security audit of a TNFT Marketplace, a Stablecoin, and over 45 Smart Contracts.

Cyberscope and Tangible Store Audit - Case Study

## Web23 - Smart Domains Tokenized on Hedera

[Web23](https://web23.io/) is a DNS platform. It allows users to register and tokenize domain names based on Hedera Hashgraph. It aims to provide utility and accessibility to the domain industry. Web23 focuses both on Web2 and Web3 technologies. They have implemented a service on the blockchain that allows users to buy, sell and manage their domain names.

[Hedera Hashgraph](https://hedera.com/) is a distributed ledger technology (DLT) platform that uses a novel consensus mechanism called "hashgraph consensus" to achieve high levels of performance, security, and decentralization.

The Web23 mission is to dominate both Internet Corporation for Assigned Names ([ICANN](https://www.icann.org/)) Web2 and Web3 domain name registration. They are moving forward to fill the gap between Web2 and Web3 by integrating the decentralized world into the browser. This will essentially bridge the Domain Name Service (DNS) to the DLTs technology.

The Web23 ecosystem consists of many sections, including the Smart domains, Regular domains, security, and tools like the dashboard and the Chrome extension.

**Smart Domains**

The users have the ability to search and purchase domain names. The purchase process is implemented by minting NFTs as domain name collateral. Users can assign the Smart Domains to Smart functions via a powerful dashboard.

**Regular Domains**

Web23 provides functionality for regular domains as well. The corresponding smart domain features are also available in the Web2 domains. The users can purchase ICANN domains. Additionally, they can transfer and manage their holdings from the Web23 dashboard. Both Web2 and Web3 administration is achieved from the same platform.

**Security and Privacy**

The Web23 ecosystem has implemented an algorithm that scans for potential look-alike domains. This algorithm protects the user’s identity and prevents phishing attacks.

**Chrome Extension**

Web23 has also developed a [Google Chrome extension](https://chrome.google.com/webstore/detail/web23/pddgamncjimlcfcihdfmfkplfbkdpjec) to provide access to Smart Domains. The extension turns the .hbar extension into a meaningful token. When a Smart domain address is typed in the Chrome extension, the DNS is resolved and it accesses the decentralized data.

![Web23 Cyberscope Audit Requirements](https://firebasestorage.googleapis.com/v0/b/cyberscope-90197.appspot.com/o/blog%2Fcyberscope-and-web23-audit-case-study%2F1.png?alt=media)

## Requirements

Web23 has a challenging infrastructure that consists of many entities like the Dashboard, the Chrome Extension, and the Web3 service. The main focus of the Web23 team was to ensure that the Web3 part is robust. They were aiming to make clear that their functionality does not produce any vulnerabilities. Their main requirement consists of a powerful audit assessment that will investigate all the aspects of their web3 section. Additionally, they were searching for a full-coverage thorough testing report that will cover all the potential scenarios. The Cyberscope team discussed with the Web23 team all their requirements and then they created a thorough plan for the two parts of the assessment delivery process.

## Unit Tests

Unit tests in the context of a blockchain project are tests that are used to verify the functionality of individual units of code in a Solidity smart contract. The purpose of unit tests is to ensure that the individual units of code in a smart contract are working correctly. This can help to identify bugs and other issues in the early stages before the production release. A well-formed exhaustive unit test implementation could save time and resources in the long run.

The Web23 team provided a document with all the sections that the unit tests should cover. The Cyberscope team’s mission was to enrich these scenarios with as many cases as possible. They had to identify all the aspects of the application to create meaningful testing scenarios. These scenarios should provide 100% code coverage and business logic validation both in the normal and the edge cases.

The Cyberscope engineers defined a set of test cases that exercise various scenarios and inputs for the contract. These test cases are then run against the contract code to verify that it is functioning correctly.

[Hardhat](https://hardhat.org/) was the tool that was chosen as the testing framework. Hardhat contains built-in support for unit tests. It is a convenient tool for developing and testing Solidity code. It also provides a simple and intuitive way to write and run tests for smart contracts.

![Cyberscope Web23 Unit Tests Assessment](https://firebasestorage.googleapis.com/v0/b/cyberscope-90197.appspot.com/o/blog%2Fcyberscope-and-web23-audit-case-study%2F2.png?alt=media)

As an integral part of the auditing process, 15 scenarios were scripted to test the contract’s functionality. The numbers in parenthesis are depicting the corresponding Web23 document scenario. The bullets without parenthesis are additional scenarios that the Cyberscope team created.

* Should receive payment and mint successfully (1,6)
* Should setDomainAsset successfully (1,2)
* Should return empty value in an unregistered domain (1)
* Should check if the domain exists
* Should check if the sender is the owner
* Should blacklist a domain (3)
* Should not allow an unregistered domain
* Should allow a registered domain (4,7)
* Should update the site address (5,7)
* Should update the site address only from the owner (5)
* Should not allow changing an unregistered site address (5)
* Should book a domain when payment received (6)
* Should get all registered domains (8)
* Should check that domain exists (9)
* Should receive multiple payments (7,9,10)

The unit tests are included in the delivery folder in the Cyberscope audit repository. Read the [unit tests here](https://github.com/cyberscope-io/audits/tree/main/web23/tests). [](https://github.com/cyberscope-io/audits/tree/main/web23/tests)

## Audit Assessments

The Web23 ecosystem mainly consists of two entities. The Hedera integration and the Smart domain registry. So the audit should take into consideration these two entities and the combinations between them. The team should investigate a variety of cases. For example:

* A user can exploit the contract and take access to an unauthorized domain.
* A user can purchase a domain without paying fees.
* Users can pass unexpected values to the registry.

The Cyberscope team always uses more than one auditor in order to create a comprehensive audit report. The auditors collaborate with each other and combine their findings if there are any differentiations. Their initial task was to get a comprehensive understanding of the Web23 ecosystem. They thoroughly went through the documentation, the required business logic and the Hedera API integration. Then, they proceeded to do a manual line-by-line check audit of each smart contract. At this point, the Cyberscope auditors pointed out to the Web23 team some medium and high criticality findings.

| Severity          | Code | Title                                      |
| ----------------- | ---- | ------------------------------------------ |
| Critical          | BFA  | Booking Functionality Abuse                |
| Medium            | BLC  | Business Logic Concern                     |
| Medium            | RVC  | Return Value Conflict                      |
| Minor/Informative | CO   | Code Optimization                          |
| Minor/Informative | CR   | Code Repetition                            |
| Minor/Informative | RIC  | Range Index Check                          |
| Minor/Informative | DSC  | Domain Sanity Check                        |
| Minor/Informative | ASC  | Address Sanity Check                       |
| Minor/Informative | RSV  | Redundant State Variable                   |
| Minor/Informative | PAE  | Precondition Abort Explanation             |
| Minor/Informative | USV  | Unaccessible State Variable                |
| Minor/Informative | MMN  | Μisleading Method Name                     |
| Minor/Informative | L01  | Public Function could be Declared External |
| Minor/Informative | L02  | State Variables could be Declared Constant |
| Minor/Informative | L04  | Conformance to Solidity Naming Conventions |
| Minor/Informative | L05  | Unused State Variable                      |
| Minor/Informative | L09  | Dead Code Elimination                      |
| Minor/Informative | L11  | Unnecessary Boolean equality               |
| Minor/Informative | L14  | Uninitialized Variables in Local Scope     |

**Critical Severity Finding**

Any user could exploit a method limitation and purchase smart domains with zero price, without limit. This vulnerability could be manipulated by the attacker and produce unwanted issues. The Cyberscope team brought up the finding with the developers of the Web23 team. Since it was not just a code glitch, but a business logic decision, they suggested ways that it could be addressed in order to avoid being exploited in the future.

**Medium Severity Finding**

The smart contract implemented an algorithm to determine the location of the dot (.) delimiter. This algorithm wrongly assumed that there was no delimiter even if the delimiter was the first character of the domain.

Read all of the [findings on the initial delivery report here](https://github.com/cyberscope-io/audits/blob/main/web23/v1/audit.pdf). [](https://github.com/cyberscope-io/audits/blob/main/web23/v1/audit.pdf)

## Feedback and Iterations

The Cyberscope team delivered a comprehensive audit report with suggestions for every finding. Sometimes the suggestions should take into consideration the expected business logic requirements. In these cases, the Cyberscope team discusses with the client about the potential approaches that they could take. Web23 developers had open communication with the Cyberscope auditors in order to clean up and address all the issues. As part of the iteration process, the teams set up further video calls in order to ensure all findings were addressed properly.

When the discussion finished, the Web23 team changed the source code with various additions and modifications. In their latest commit, they decreased the findings from 15 in the initial report to only 3 in the latest report. The most important critical and medium-severity issues were addressed.

R﻿ead the [full report here](https://github.com/cyberscope-io/audits/blob/main/web23/audit.pdf).[](https://github.com/cyberscope-io/audits/blob/main/web23/audit.pdf)

## Web23 and Cyberscope

The collaboration between Web23 and Cyberscope was essential for both parties. The cyberscope team identified various issues that could potentially create unexpected behaviour and unpredictable side effects to the Web23 ecosystem. Web23 team acted quickly to remediate all the issues reported by the auditors. After a few meaningful discussions, they created a revision of the smart contracts that addressed almost all of the issues.

Finally, the validation of the expected functionality did not stop in the audit assessment report. The Cyberscope team also delivered a full coverage unit-tests report in order to make sure that the codebase is following the expected behaviour.

## Long-Term Collaboration

The Cyberscope team always goes above and beyond regarding the client’s requirements, delivery times, and expectations. Web23 and Cyberscope achieved a lot in a just short period of time by helping them secure their smart contract and allowing them to scale safely.

Web23 is a project that is growing rapidly and building tools in a variety of domains. Since the beginning of their collaboration with Cyberscope, they have implemented a Chrome extension, an administration dashboard and many more features are under development.

Cyberscope and Web23 will continue working together in order to secure their ecosystem and make web3.0 a safer place for the domain name space.

Resources

DeFi Kingdom and Cyberscope - Case Study

Origin Protocol (OGN) x Cyberscope Audit - Case Study

ApeSwap x Cybercope - Case Study

Quarashi x Cybercope Audit and Consulting Case Study

Cyberscope and Tangible Store Audit - Case Study

Web23 and Cyberscope Audit - Case Study

Recent Posts

DeFi Kingdom and Cyberscope - Case Study

Origin Protocol (OGN) x Cyberscope Audit - Case Study

ApeSwap x Cybercope - Case Study

Quarashi x Cybercope Audit and Consulting Case Study

Subscribe To Our Newsletter