If you notice some outdated information please let us know!
FAIL
The final review score is indicated as a percentage. The percentage is calculated as Achieved Points due to MAX Possible Points. For each element the answer can be either Yes/No or a percentage. For a detailed breakdown of the individual weights of each question, please consult this document.
Very simply, the audit looks for the following declarations from the developer's site. With these declarations, it is reasonable to trust the smart contracts.
This report is for informational purposes only and does not constitute investment advice of any kind, nor does it constitute an offer to provide investment advisory or other services. Nothing in this report shall be considered a solicitation or offer to buy or sell any security, token, future, option or other financial instrument or to offer or provide any investment advice or service to any person in any jurisdiction. Nothing contained in this report constitutes investment advice or offers any opinion with respect to the suitability of any security, and the views expressed in this report should not be taken as advice to buy, sell or hold any security. The information in this report should not be relied upon for the purpose of investing. In preparing the information contained in this report, we have not taken into account the investment needs, objectives and financial circumstances of any particular investor. This information has no regard to the specific investment objectives, financial situation and particular needs of any specific recipient of this information and investments discussed may not be suitable for all investors.
Any views expressed in this report by us were prepared based upon the information available to us at the time such views were written. The views expressed within this report are limited to DeFiSafety and the author and do not reflect those of any additional or third party and are strictly based upon DeFiSafety, its authors, interpretations and evaluation of relevant data. Changed or additional information could cause such views to change. All information is subject to possible correction. Information may quickly become unreliable for various reasons, including changes in market conditions or economic circumstances.
This completed report is copyright (c) DeFiSafety 2023. Permission is given to copy in whole, retaining this copyright label.
This section looks at the code deployed on the relevant chain that gets reviewed and its corresponding software repository. The document explaining these questions is here.
1. Are the smart contract addresses easy to find? (%)
No smart contract addresses can be found in the Biswap documentation.
2. How active is the primary contract? (%)
Biswap is used 44,041 times a day, as indicated in the Appendix, found at https://biswap.org/analytics.
3. Does the protocol have a public software repository? (Y/N)
Biswap uses GitHub at https://github.com/biswap-org/core.
4. Is there a development history visible? (%)
Biswap's core repository has only 5 commits and 1 branch, as indicated at https://github.com/biswap-org/core. As such, this is a very underdeveloped repository for such an advanced and popular DeFi application.
5. Is the team public (not anonymous)?
The "Team" section (https://biswap.org/team) provides animated faces, first names and descriptions, but no real traceable people associated with the protocol, therefore we classify it as anonymous.
This section looks at the software documentation. The document explaining these questions is here.
6. Is there a whitepaper? (Y/N)
Location: https://docs.biswap.org.
7. Is the protocol's software architecture documented? (Y/N)
No software architecture is documented in Biswap's documentation.
8. Does the software documentation fully cover the deployed contracts' source code? (%)
There is zero coverage of Biswap's deployed contracts by software function documentation.
9. Is it possible to trace the documented software to its implementation in the protocol's source code? (%)
There is zero traceability between Biswap's software documentation and implemented code, the former being completely inexistant.
10. Has the protocol tested their deployed code? (%)
Code examples are in the Appendix at the end of this report.. As per the SLOC, there is 7% testing to code (TtC). This score is guided by the Test to Code ratio (TtC). Generally a good test to code ratio is over 100%. However, the reviewer's best judgement is the final deciding factor.
11. How covered is the protocol's code? (%)
Biswap seemingly does not have any evidence of code coverage tests.
12. Does the protocol provide scripts and instructions to run their tests? (Y/N)
No Biswap scripts or instructions to run tests were found.
13. Is there a detailed report of the protocol's test results?(%)
There is no detailed test report of the Biswap test run results.
14. Has the protocol undergone Formal Verification? (Y/N)
Biswap has not undergone a formal verification test.
15. Were the smart contracts deployed to a testnet? (Y/N)
There is no evidence to show that Biswap was deployed to a testnet.
This section looks at the 3rd party software audits done. It is explained in this document.
16. Is the protocol sufficiently audited? (%)
A single audit was performed by Certik before deployment at: https://biswap.org/pdf/BiswapAudit.pdf. Since the contract addresses were not found, the score is 0% because the executing code could be different than the audited code without being able to verify. In addition, it is unclear whether the recommended fixes from the Certik report were ever implemented by the Biswap team. This is concerning because, according to the Certik website, the outlined medium issues pertaining to centralization / privileges are still unresolved after 9 months. Another issue of the same kind was found in a subsequent audit, and this one also remains unsolved.
17. Is the bounty value acceptably high (%)
Biswap offers an inactive bug bounty of up to $100K.
This section covers the documentation of special access controls for a DeFi protocol. The admin access controls are the contracts that allow updating contracts or coefficients in the protocol. Since these contracts can allow the protocol admins to "change the rules", complete disclosure of capabilities is vital for user's transparency. It is explained in this document.
18. Is the protocol's admin control information easy to find?
No admin control information was found within Biswap's documentation.
19. Are relevant contracts clearly labelled as upgradeable or immutable? (%)
No admin control information was found, and therefore nothing regarding the status of Biswap's smart contract mutability/immutability.
20. Is the type of smart contract ownership clearly indicated? (%)
No admin control information was found regarding the ownership of Biswap's smart contracts.
21. Are the protocol's smart contract change capabilities described? (%)
No admin control information was found regarding the Biswap's team's capabilities in changing/upgrading the protocol's smart contracts.
22. Is the protocol's admin control information easy to understand? (%)
No admin control information was found within Biswap's documentation.
23. Is there sufficient Pause Control documentation? (%)
Biswap's pause control or any similar functions are not documented or explained.
24. Is there sufficient Timelock documentation? (%)
No time lock information was identified in Biswap's documentation, and no explanations were provided about any potential reasons that would justify the absence of one.
25. Is the Timelock of an adequate length? (Y/N)
No time lock information was identified within Biswap's documentation, and certainly not its duration.
This section goes over the documentation that a protocol may or may not supply about their Oracle usage. Oracles are a fundamental part of DeFi as they are responsible for relaying tons of price data information to thousands of protocols using blockchain technology. Not only are they important for price feeds, but they are also an essential component of transaction verification and security. These questions are explained in this document.
26. Is the protocol's Oracle sufficiently documented? (%)
Although the usage of a price oracle is mentioned [here]https://docs.biswap.org/biswap-gamefi/squid-nft-world/gameplay/minting-a-bus), the source is not identified and further explanations are not provided.
27. Is front running mitigated by this protocol? (Y/N)
Biswap's documentation does not mention front running or any countermeasure against it.
28. Can flashloan attacks be applied to the protocol, and if so, are those flashloan attack risks mitigated? (Y/N)
Biswap documents that a specific line of code protects against flash loan attacks. Author claims this is implemented so that "the attacker cannot do reentrancy and perform a second swap before reserves are updated".
1contract MasterChef is Ownable {
2 using SafeMath for uint256;
3 using SafeBEP20 for IBEP20;
4 // Info of each user.
5 struct UserInfo {
6 uint256 amount; // How many LP tokens the user has provided.
7 uint256 rewardDebt; // Reward debt. See explanation below.
8 //
9 // We do some fancy math here. Basically, any point in time, the amount of BSWs
10 // entitled to a user but is pending to be distributed is:
11 //
12 // pending reward = (user.amount * pool.accBSWPerShare) - user.rewardDebt
13 //
14 // Whenever a user deposits or withdraws LP tokens to a pool. Here's what happens:
15 // 1. The pool's `accBSWPerShare` (and `lastRewardBlock`) gets updated.
16 // 2. User receives the pending reward sent to his/her address.
17 // 3. User's `amount` gets updated.
18 // 4. User's `rewardDebt` gets updated.
19 }
20 // Info of each pool.
21 struct PoolInfo {
22 IBEP20 lpToken; // Address of LP token contract.
23 uint256 allocPoint; // How many allocation points assigned to this pool. BSWs to distribute per block.
24 uint256 lastRewardBlock; // Last block number that BSWs distribution occurs.
25 uint256 accBSWPerShare; // Accumulated BSWs per share, times 1e12. See below.
26 }
27 // The BSW TOKEN!
28 BSWToken public BSW;
29 //Pools, Farms, Dev, Refs percent decimals
30 uint256 public percentDec = 1000000;
31 //Pools and Farms percent from token per block
32 uint256 public stakingPercent;
33 //Developers percent from token per block
34 uint256 public devPercent;
35 //Referrals percent from token per block
36 uint256 public refPercent;
37 //Safu fund percent from token per block
38 uint256 public safuPercent;
39 // Dev address.
40 address public devaddr;
41 // Safu fund.
42 address public safuaddr;
43 // Refferals commision address.
44 address public refAddr;
45 // Last block then develeper withdraw dev and ref fee
46 uint256 public lastBlockDevWithdraw;
47 // BSW tokens created per block.
48 uint256 public BSWPerBlock;
49 // Bonus muliplier for early BSW makers.
50 uint256 public BONUS_MULTIPLIER = 1;
51 // The migrator contract. It has a lot of power. Can only be set through governance (owner).
52 IMigratorChef public migrator;
53 // Info of each pool.
54 PoolInfo[] public poolInfo;
55 // Info of each user that stakes LP tokens.
56 mapping(uint256 => mapping(address => UserInfo)) public userInfo;
57 // Total allocation poitns. Must be the sum of all allocation points in all pools.
58 uint256 public totalAllocPoint = 0;
59 // The block number when BSW mining starts.
60 uint256 public startBlock;
61 // Deposited amount BSW in MasterChef
62 uint256 public depositedBsw;
63
64 event Deposit(address indexed user, uint256 indexed pid, uint256 amount);
65 event Withdraw(address indexed user, uint256 indexed pid, uint256 amount);
66 event EmergencyWithdraw(
67 address indexed user,
68 uint256 indexed pid,
69 uint256 amount
70 );
71
72 constructor(
73 BSWToken _BSW,
74 address _devaddr,
75 address _refAddr,
76 address _safuaddr,
77 uint256 _BSWPerBlock,
78 uint256 _startBlock,
79 uint256 _stakingPercent,
80 uint256 _devPercent,
81 uint256 _refPercent,
82 uint256 _safuPercent
83 ) public {
84 BSW = _BSW;
85 devaddr = _devaddr;
86 refAddr = _refAddr;
87 safuaddr = _safuaddr;
88 BSWPerBlock = _BSWPerBlock;
89 startBlock = _startBlock;
90 stakingPercent = _stakingPercent;
91 devPercent = _devPercent;
92 refPercent = _refPercent;
93 safuPercent = _safuPercent;
94 lastBlockDevWithdraw = _startBlock;
95
96
97 // staking pool
98 poolInfo.push(PoolInfo({
99 lpToken: _BSW,
100 allocPoint: 1000,
101 lastRewardBlock: startBlock,
102 accBSWPerShare: 0
103 }));
104
105 totalAllocPoint = 1000;
106
107 }
108
109 function updateMultiplier(uint256 multiplierNumber) public onlyOwner {
110 BONUS_MULTIPLIER = multiplierNumber;
111 }
112