ETH_TheWallV3_report.md

TheWALL v3 Audit Report.

1. Summary

This document is a security audit report performed by RideSolo, where TheWALL has been reviewed.

2. In scope

• thewall.sol github commit hash 4d7b98e06def9a605aba06663d5c90d5a5e55c54.
• thewallbeneficiaries.sol github commit hash 607640150491de8bdd0ff3414a7ed5017f4b84b6.
• thewallcore.sol github commit hash 4d7b98e06def9a605aba06663d5c90d5a5e55c54.
• thewallcoupons.sol github commit hash 607640150491de8bdd0ff3414a7ed5017f4b84b6.
• thewallusers.sol github commit hash 607640150491de8bdd0ff3414a7ed5017f4b84b6.

3. Findings

3 issues were reported including:

• 1 low.
• 3 owner privileges.

3.1. Premium Computing

Severity: medium

Description

Please note that this issue is not an owner privilege but a logical flow issue, the result are actual losses for the users.

The frequency at which commitSecret and updateSecret is called is important to the users. If a user that created new area want to rent or sell it and the owner didn't call commitSecret for his hash then isPremium will return false, resulting in a loss of 30% (fee charged) even if his nonce and secret will give him a premium area. If the secret is committed later, a possible new owner will have access to the premium discount.

Code snippet

https://github.com/isvirin/TheWall/blob/4d7b98e06def9a605aba06663d5c90d5a5e55c54/thewallcore.sol#L154

https://github.com/isvirin/TheWall/blob/4d7b98e06def9a605aba06663d5c90d5a5e55c54/thewallcore.sol#L146)

3.2. Owner Privileges

severity: medium

Description

• Change area price.
• Change wall size.
• The owner can tamper with the random values since no decentralized oracle is used when using update and commit

3.3. Zero Address Check

severity: low

Description

• Check coupons contract address to be different than zero inside the constructor of TheWallUsers.
• Check the updated coupons contract address to be different than zero here.

Conclusion

All highlighted issues should be fixed.