The Beam protocol focuses on cross-chain DeFi applications, offering a robust ecosystem with integrated features for liquidity incentives, tokenomics, and governance.The protocol leverages ZetaChain for cross-chain messaging, enabling interactions between Bitcoin, Ethereum, and other ecosystems.
Low | Medium | High | Critical | Total | |
---|---|---|---|---|---|
Not fixed | - | - | - | - | 0 |
Fixed | 3 | 2 | - | - | 5 |
Total | 3 | 2 | 0 | 0 | 5 |
fixed/medium
There is an edge case where rounding issue can create dust amount which will accumulate overtimewhenever swap happens. However there is no way to pull those funds out.
fixed/medium
The current implementation of _executeSwap might not be able to handle Fee on Transfer Tokens.This is because the router will receive less amount than expected and will then proceed to execute as if the input amount is same.
fixed/low
The current code lack input sanitization of the parameters that are passed. This leads to break a wholelot of invariants that a router should hold creating in unintended consequences. Here is a list of core invariants that should be checked. A route must consist at least of two tokens. RouterLogic must never consume more input tokens than the provided. Only the Router can invoke swapExactInput/swapExactInputSingle. Amounts must never be larger than uint128.max. During swapExactInput, all input amounts must be consumed without any leftovers. Token addresses must be unique.
fixed/low
Currently swapExactInput , swapExactInputSingle lacks non-reentrant modifer. This means that thereis a scenario under which one can reenter into these function before the previous execution is fnished. While an actual reentrant poc has not be crafted, it has been observed that most of exploits happen due to arbitrary user input. Therefore it is crucial to limit the user fexibility.
fixed/low
Contract contains unused elements that do not serve any functional purpose, increasing the codebase size unnecessarily:event: CustomApproval, errors: WrongGasContract, NotEnoughToPayGasFee, ChainNotEnabled and INIT_CODE_HASH: is declared but not utilized in any function
# | File Name |
---|---|
1 | UniswapV2Library.sol |
2 | BitcoinRouter.sol |
3 | SafeMath.sol |
4 | MessageParserLib.sol |
5 | BitcoinMessageParserLib.sol |
6 | MultichainRouter.sol |
7 | AlgebraSwapHelperLib.sol |