Zellic - Audit Reports

Assessment reports>Initia>Discussion>Improve AMM tests

Findings

DiscussionGeneral Discussion Improve AMM tests Bridge executor minting power Charge before using values Empty allowed_publishers array allows every address to publish ERC20Keeper with custom contracts Suggestions for additional security checks Table handle overflow leads to abort

Threat ModelWhat are threat models?stdlib

Audit ResultsSummary

AppendixProof of concept: Reference safety verifier bypass

Improve AMM tests

We strongly recommend creating a more thorough testing suite for dex.move, stableswap.move, and minitswap.move to ensure correctness. Subtle bugs hiding in code are less likely to exist when the test suite is comprehensive. Ensure the test suite is comprehensive — covering edge cases and extreme values — and achieves as close to 100% code coverage as possible. Additionally, consider implementing fuzz testing and formal verification where applicable using the Move prover.