Smart Contract Audit (Hacken)

On behalf of WeSendit, Hacken carried out a smart contract code review and security analysis of the WeSendit Token ($WSI). The review took place from 3 to 20 October 2022 and consisted of an initial review and a second review on 20 October 2022.

The review covered an ERC20 token system written in Solidity on BNB Smart Chain (BSC). It included the following contracts from the wesenditmedia/contracts repository:

• WeSenditToken / BaseWeSenditToken: the ERC20 token with fee functionality
• DynamicFeeManager / BaseDynamicFeeManager: adding and calculating fees
• EmergencyGuard: allows the administration to withdraw funds from the contracts
• the related interfaces

Hacken reviewed the code manually, analysed it with automated tools and assessed the system architecture. The code was checked against known vulnerabilities from the SWC Registry and against further criteria, including:

• access control for critical functions
• protection of user balances from third parties
• token minting only according to the documented rules
• protection against flash loan attacks
• compliance with EIP standards
• full test coverage

In the second review, all applicable criteria were marked as passed. Some criteria were not relevant to these contracts.

Hacken uses four severity levels: critical (easy to exploit, can lead to loss of funds or data manipulation), high (difficult to exploit, but with significant impact), medium (important to fix, but cannot lead to loss of funds) and low (mostly outdated or unused code without significant impact).

The initial review identified 18 findings: 2 critical, 4 high, 4 medium and 8 low.

Critical findings: Two settings for swaps via PancakeSwap could be changed by anyone. In addition, liquidity for the BNB/WSI pair was not added as documented.

High findings: The sum of all fees could exceed the defined limit and thereby block transfers. A fee function could be called by anyone, which could have led to losses for approved balances. There was also an incorrect calculation of fee amounts, and too many fee entries could have blocked transfers.

Medium and low findings: These concerned, among other things, redundant code, missing notifications when important settings were changed, an unchecked return value when adding liquidity, an unlocked compiler version and missing checks for empty addresses.

All 18 findings were fixed. In the second review on 20 October 2022, no findings remained open.

After the second review, Hacken rated the smart contracts 10.0 out of 10:

• Documentation: 10 out of 10. Functional requirements and technical description are provided.
• Code quality: 10 out of 10. The development environment is configured and the code follows the official Solidity guidelines.
• Test coverage: 100%. Deployment and basic use, negative cases and use by multiple users are covered by tests.
• Security: 10 out of 10. No open findings.

The contracts include administrative roles. Among other things, the administration can add and remove fees, grant roles, enable or disable fees, unpause the token contract and withdraw tokens and BNB from the contracts. Further roles allow addresses to be exempt from fees or from a pause.

Hacken lists three risks in the report:

• The token administration can replace the fee manager at any time. This can lead to transfers being stopped or fees being increased.
• Under certain settings, the automatic swap does not take the current reserves of the trading pair into account.
• After an emergency withdrawal by the administration, fee entries are not updated automatically and need to be replaced.

The report covers only the code that was submitted and reviewed and may no longer be accurate after changes. It does not guarantee that all vulnerabilities have been found. Hacken recommends not relying on this report alone, but carrying out several independent audits and a public bug bounty programme.

The report was written in English. In case of discrepancies, the English version prevails.

The full audit report by Hacken is available here: Hacken Audit Report