Smart Contract Audits (Solidproof)

On behalf of WeSendit, Solidproof (Solidproof.io, a brand of MAKE Network GmbH, Germany) carried out three smart contract security audits:

• Token contracts: October 2022
• Staking contracts: January 2023
• RewardDistributor and PaymentProcessor: December 2023

For the audits, Solidproof was given access to WeSendit's code repository and, for the first two audits, to the whitepaper.

All three audits follow the same methodology. Solidproof's team reviewed the documentation provided, reviewed the code manually line by line and checked whether it does what the documentation describes. Automated analysis was used in addition, including test coverage analysis and symbolic execution. Symbolic execution determines which inputs trigger which parts of a program. Finally, the code was checked against best practices.

Findings are rated on the basis of CVSS 3.0 in five levels: critical, high, medium, low and informational. Informational notes have no effect on the code.

Scope: The audit covered the WeSendit Token and the DynamicFeeManager on Binance Smart Chain (BEP20). The report is dated 22 October 2022.

Result: The results section lists no findings. Two notes are documented together with a statement from the WeSendit team:

• Missing zero address check (low): The team states that no zero address will be set when deploying the contract.
• Missing NatSpec documentation (informational): The comments are kept in the interfaces rather than in the main contracts.

All 36 checks against known vulnerabilities from the SWC Registry were passed.

Verified properties:

• The contract cannot be replaced afterwards (not upgradeable).
• The ERC20 standard functions are implemented correctly.
• The deployer cannot mint new tokens. The maximum supply is 1,500,000,000 tokens.
• The deployer cannot lock or burn user funds. Holders can burn their own tokens.
• The contract contains a pause state but can only be unpaused, not paused again.
• Fees cannot be set above 25%.
• There is no function for blacklisting addresses.

Privileges according to the report: The deployer can unpause the contract, enable or disable fees, decrease fees once and set various addresses, including the fee manager and the PancakeSwap addresses. The administration can withdraw BNB and tokens from the contracts and add or remove fees. Because several addresses are authorised, other addresses remain able to act even if ownership is renounced. Solidproof explicitly points this out.

Scope: The audit covered the staking pool contracts. The initial audit took place on 9 January 2023, the re-audit on 18 January 2023.

Result: No critical, high, medium or low findings were identified. There is one informational note about missing NatSpec documentation. All 36 SWC checks were passed.

Verified properties:

• The contract cannot be replaced afterwards.
• The ERC20 standard functions are implemented correctly.
• The deployer can pause the contract and thereby lock user funds.

Privileges according to the report: The owner can pause the contract, set the rewards claim interval and withdraw tokens from the contract. At the time of the re-audit, the owner role still existed.

Scope: The audit covered the RewardDistributor and PaymentProcessor contracts. The initial audit took place on 14 December 2023, the re-audit on 19 December 2023. According to the report, the audit did not include functional testing and no unit tests were provided. The logical correctness of calculations, such as the formulas used, is therefore not fully guaranteed.

Result: No critical, high or low findings were identified. Two medium findings and one informational note were acknowledged by the team («Acknowledged»). This means they were not changed but declared part of the intended logic:

• Removal of unclaimed rewards (medium): An authorised role can transfer a user's claimable rewards to the fee wallet without the user's approval. Team statement: this happens if a user has been inactive for 200 days and has not claimed the tokens. The tokens are sent to the activity pool to be distributed in the future.
• Fee calculation without precision factor (medium): The calculation could fail for fees below 1. Team statement: a test with 200 Wei correctly resulted in 194 Wei for the user and 6 Wei for the fee wallet, as amounts are already calculated with 1e18.
• Missing NatSpec documentation (informational): The documentation is in the interfaces.

Verified properties:

• The contracts cannot be replaced afterwards.
• The owner cannot mint tokens.
• The owner cannot burn tokens without an allowance.
• The owner cannot blacklist addresses or lock the contract.
• Fees cannot be changed. The contract includes a transfer fee of 3%.
• Ownership has not been renounced.

Privileges according to the report: A processor role can credit tokens to users, execute payments from a user to the contract and refund payments. The administration can withdraw ETH and tokens from the contracts, including as an emergency withdrawal.

Solidproof's recommendations:

• careful handling of the keys of privileged accounts
• multi-signature wallets
• a time delay of around 48 to 72 hours for privileged actions
• a governance module
• renouncing ownership where appropriate

The reports cover only the code reviewed in each case. According to Solidproof, they do not guarantee that the code is free of bugs, and they are neither an endorsement of a project nor investment advice. Integration with external contracts or services, such as PancakeSwap, is not part of the audits. In Solidproof's view, every individual and company is responsible for their own due diligence.

All three audit reports by Solidproof are available here: Solidproof Audit Reports