Zellic - Audit Reports

Assessment reports>Initia>Discussion>ERC20Keeper with custom contracts

Findings

DiscussionGeneral Discussion Improve AMM tests Bridge executor minting power Charge before using values Empty allowed_publishers array allows every address to publish ERC20Keeper with custom contracts Suggestions for additional security checks Table handle overflow leads to abort

Threat ModelWhat are threat models?stdlib

Audit ResultsSummary

AppendixProof of concept: Reference safety verifier bypass

ERC20Keeper with custom contracts

The EVM module currently allows anyone to create and register an ERC20 contract with a custom implementation that will then be used by the Cosmos bank module when interacting with that particular coin. This will require chains to be especially careful of any operations on coins performed in critical paths (such as in a BeginBlocker or EndBlocker) and the custom ERC-20 logic is able to fail at will or enter into an infinite loop.