Assessment reportsPublic findings
Back to Zellic siteBack
↗
Assessment reports>d3-doma>Low findings>Add an integrated test suite for all cross-chain interactions
GeneralOverview
Findings
Critical (3)
Medium (1)
Low (6)Native tokens can remain stuck in some contracts foreverRegistrars can overwrite domain-name details of other registrarsAdd an integrated test suite for all cross-chain interactionsRegistrars can pass in expiry dates from the past when renewing domainsStale oracle price riskSecondary sales in the Marketplace will revert if the fee is not set correctly
Informational (2)
Threat ModelWhat are threat models?DomaForwarder.solDomaRecordProxyFacet.solDomaRecordRegistrarClaimFacet.solDomaRecordRegistrarFacet.solERC7786GatewayReceiver.solERC7786GatewaySource.solMarketplace.solOwnershipToken.solProxyDomaRecord.sol
Audit ResultsAssessment Results
Category: Business Logic

Add an integrated test suite for all cross-chain interactions

Low Impact
Low Severity
Low Likelihood

Description

When building a complex contract ecosystem with multiple moving parts and dependencies, comprehensive testing is essential. This includes testing for both positive and negative scenarios. Positive tests should verify that each function's side effect is as expected, while negative tests should cover every revert, preferably in every logical branch.

The test coverage for this project includes a comprehensive set of positive and negative tests. However, coverage could be greatly improved with fully integrated tests that check all cross-chain functionality from start to finish. Adding such tests would allow issues such as Finding ref↗, Finding ref↗, and Finding ref↗ to be caught more easily, as it would allow checking for consistent states across chains, as well as ensuring that crucial cross-chain transactions do not revert.

We understand that it is difficult to write such test cases, as it requires locally running two or more separate node instances (one for the Doma chain and one or more for any remote chains, such as Polygon). However, we highly recommend doing this, as it makes it easier for developers to test any new functionality that is added to the chain and ensure that cross-chain states stay consistent across both chains.

Impact

The reason for this finding is because we believe that the non-existence of an integrated test suite is the sole reason behind the existence of some of the issues we've found in this code base. We think it's reasonable to treat this as a finding, as it needs to be fixed so that such issues can be caught in the future by the test suite.

Recommendations

Add an integrated test suite that tests all cross-chain interactions in an end-to-end manner.

Remediation

The D3 Doma Team's position is as follows:

All flows are covered by Doma Backend end-to-end tests (which include actual contracts on testnets). While having an end-to-end test suite at the contract level would be beneficial, the actual implementation has been postponed as it requires a significant amount of effort.

Zellic © 2025Back to top ↑