Zellic - Audit Reports

Assessment reports>Initia>Threat Model>Module hex.move

Findings

DiscussionGeneral Discussion Improve AMM tests Bridge executor minting power Charge before using values Empty allowed_publishers array allows every address to publish ERC20Keeper with custom contracts Suggestions for additional security checks Table handle overflow leads to abort

Audit ResultsSummary

AppendixProof of concept: Reference safety verifier bypass

Module hex.move

This module exposes functions encode_to_string and decode_string that can be used to encode and decode a vector of bytes to/from hexadecimal. An issue with decode_string accepting invalid hexadecimal characters is discussed in Finding ref↗.