Prepared by Fuzzland

Overview

This document details our collaborative engineering effort with Oracly regarding their protocol. In this system, participants engage in parimutuel, or pool, betting on the price fluctuations of various cryptocurrencies. Here, all wagers predicting a specific price shift are accumulated into a single pool. After the deduction of commisions, the remaining funds are distributed among the winners, with the payout odds determined by dividing the pool among all successful bets.

Targets

Disclaimer

The audit does not ensure that it has identified every security issue in the smart contracts, and it should not be seen as a confirmation that there are no more vulnerabilities. The audit is not exhaustive, and we recommend further independent audits and setting up a public bug bounty program for enhanced security verification of the smart contracts. Additionally, this report should not be interpreted as personal financial advice or recommendations.

Auditing Process

• Static Analysis: We perform static analysis using our internal tools and Slither to identify potential vulnerabilities and coding issues.
• Fuzz Testing: We execute fuzz testing with our internal fuzzers to uncover potential bugs and logic flaws.
• Invariant Development: We convert the project into Foundry project and develop Foundry invariant tests for the project based on the code semantics and documentations.
• Invariant Testing: We run multiple fuzz testing tools, including Foundry and ItyFuzz, to identify violations of invariants we developed.
• Formal Verification: We develop individual tests for critical functions and leverage Halmos to prove the functions in question are not vulnerable.
• Manual Code Review: Our engineers manually review code to identify potential vulnerabilities not captured by previous methods.

Update 1 Summary

markets/finance/MetapoolContract.sol

• Added expiration logic