Venom Bridge

CertiK3 Nov 2022Files named in the report

CertiK reviewed Venombridge (Venom Bridge) on 3 Nov 2022: 33 findings, 0 critical; 19 marked fixed, 5 acknowledged, 9 open.

No open critical findings

Open the report Open Venombridge’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings33

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	5	2
Medium	0	0	6
Low	9	0	11

LowDao Contract Can Execute Arbitrary Call Defined IOpen

Any staker above a certain staking threshold can add proposals, and there is no restriction on the `tonActions` and `ethActions` in the proposal, including the target address and the function call itself. If a malicious proposal is added and passes the voting process, the DAO contract can execute the actions defined in the proposal on the Everscale side and/or the Ethereum side.

LowImplementation Not Match With DesignOpen

The "confirm" and "reject" function has the following comment: ```txt @dev Can be called only by parent event configuration @dev Can be called only when event configuration is in Pending status ``` The implementation doesn't match the comment: 1. The function can be called by selected relays, instead of only the parent event configuration. 2. The "confirm" function can be called in the "Pending" status and "Confirmed" status, instead of only in the Pending status 3. The "reject" function can be called in any status.

LowIncompatibility With Non Standard TokensOpen

The staking module is not compatible with non-standard ERC20 tokens, such as deflationary tokens or rebase tokens. Deflationary token is defined as a token with transfer fees, such that the amount received by the recipient is less than the amount sent by the sender. There are plenty of such tokens in other layer 1 protocols. The staking contract records the `amount` being transferred by the staker as its staking balance. If the token itself is deflationary, this would inaccurately reflect the amount of tokens received by the staking contract, causing loss of fund when the staker withdraws its staked tokens. ```solidity token_balance += _tokens_to_deposit; ```

LowLack of access control for the `deployAlienToken(Open

In ProxyMultiVaultAlien_V3.sol, anyone can call `deployAlienToken()` to deploy new alien token.

LowLack of access control for the `deployConnector()Open

The "deployConnector()" function is public and has no access control. Anyone can deploy a new connector to increase the connector count.

LowLack of access control for the `deployMergeRouterOpen

In ProxyMultiVaultAlien_V3.sol, anyone can call `deployMergeRouter()` to deploy new merge router.

LowOut of Scope Dependencies (EVM)Open

The contracts are serving as the underlying entity to interact with third parties SushiSwap, Convex Finance's Booster Contract, and tokens(e.g. usdt). The scope of the audit treats 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc. Note that the liquidity pools may be prone to flash loan attacks, which may cause losses to the strategies and the vault.

LowOut of Scope Dependencies(Relay)Open

The communication for the bridge between the Everscale blockchain and multiple EVM chains is via different "events". For example, when a user bridges a token from Eversacle to Ethereum, a "TokenTransferEvent" will be deployed, and "Relay" need to verify the event. The user needs to use the signature from the "Relay" to withdraw the token from the Ethereum vault. The "Relay" is crucial to the system; the scope of the audit treats the "Relay" entities as black boxes and assumes their functional correctness. However, in the real world, the dependencies can be compromised, and this may lead to lost or stolen assets.

LowUnknown ImplementationOpen

The implementation of several interfaces are unknown. The scope of the audit treats unknown implementation / 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (133)

everscale/contracts/bridge/alien-token/AlienTokenWalletPlatform.sol
everscale/contracts/bridge/interfaces/IProxyExtended.sol
everscale/contracts/utils/cell-encoder/CellEncoderStandalone.sol
ethereum/contracts/bridge/Bridge.sol
ethereum/contracts/multivault/interfaces/IMultiVault.sol
everscale/contracts/utils/cell-encoder/ProxyTokenTransferCellEncoder.sol
everscale/contracts/staking/UserData.sol
everscale/contracts/dao/structures/ActionStructure.sol
everscale/contracts/dao/interfaces/IVoter.sol
everscale/contracts/staking/base/StakingRelay.sol
everscale/contracts/bridge/interfaces/multivault/IMultiVaultEverscaleEventAlien.sol
everscale/contracts/bridge/proxy/alien/ProxyMultiVaultAlien_V3.sol
everscale/contracts/bridge/interfaces/event-configuration-contracts/IEverscaleEventConfiguration.sol
everscale/contracts/bridge/interfaces/alien-token-merge/IMergeRouter.sol
everscale/contracts/staking/interfaces/IRelayRound.sol
everscale/contracts/staking/interfaces/ITokensReceivedCallback.sol
ethereum/contracts/multivault/interfaces/IERC20.sol
everscale/contracts/bridge/interfaces/multivault/IMultiVaultEverscaleEventNative.sol
ethereum/contracts/Registry.sol
ethereum/contracts/vault/Vault.sol
everscale/contracts/staking/Staking.sol
everscale/contracts/bridge/alien-token/TokenRootAlienEVM.sol
everscale/contracts/bridge/factory/ProxyTokenTransferFactory.sol
everscale/contracts/bridge/event-contracts/base/EthereumBaseEvent.sol
everscale/contracts/staking/StakingV1_1.sol
everscale/contracts/bridge/event-contracts/base/EverscaleBaseEvent.sol
everscale/contracts/utils/cell-encoder/ProxyMultiVaultCellEncoder.sol
ethereum/contracts/DAO.sol
everscale/contracts/dao/DaoRoot.sol
everscale/contracts/utils/Receiver.sol
everscale/contracts/bridge/alien-token-merge/MergePool.sol
everscale/contracts/bridge/interfaces/event-contracts/IEverscaleEvent.sol
ethereum/contracts/multivault/utils/ChainId.sol
everscale/contracts/staking/RelayRound.sol
everscale/contracts/bridge/interfaces/legacy/ILegacyTransferOwner.sol
everscale/contracts/bridge/event-contracts/base/BaseEvent.sol
ethereum/contracts/multivault/utils/Initializable.sol
ethereum/contracts/multivault/MultiVaultToken.sol
everscale/contracts/bridge/event-contracts/token-transfer/TokenTransferEverscaleEvent.sol
everscale/contracts/bridge/event-configuration-contracts/EverscaleEventConfiguration.sol
everscale/contracts/bridge/interfaces/event-contracts/IBasicEvent.sol
everscale/contracts/bridge/interfaces/IConnector.sol
everscale/contracts/bridge/interfaces/multivault/IProxyMultiVaultAlien_V1.sol
everscale/contracts/staking/libraries/Gas.sol
everscale/contracts/dao/structures/PlatformTypes.sol
everscale/contracts/staking/base/StakingBase.sol
everscale/contracts/dao/interfaces/IProposal.sol
ethereum/contracts/vault/VaultHelpers.sol
everscale/contracts/bridge/interfaces/multivault/IMultiVaultEVMEventNative.sol
everscale/contracts/utils/cell-encoder/MergePoolCellEncoder.sol
ethereum/contracts/multivault/utils/Context.sol
ethereum/contracts/bridge/BridgeMockup.sol
everscale/contracts/bridge/interfaces/ITokenRootAlienEVM.sol
everscale/contracts/bridge/event-contracts/multivault/MultiVaultEVMEventAlien.sol
everscale/contracts/bridge/alien-token-merge/MergeRouter.sol
everscale/contracts/bridge/alien-token-merge/MergePoolPlatform.sol
ethereum/contracts/multivault/interfaces/proxy/IBeacon.sol
everscale/contracts/dao/libraries/DaoErrors.sol
ethereum/contracts/vault/VaultStorage.sol
everscale/contracts/utils/ErrorCodes.sol
everscale/contracts/bridge/event-contracts/staking/StakingEthEvent.sol
ethereum/contracts/multivault/proxy/Proxy.sol
everscale/contracts/staking/StakingRootDeployer.sol
everscale/contracts/staking/interfaces/IUpgradableByRequest.sol
everscale/contracts/utils/cell-encoder/DaoCellEncoder.sol
ethereum/contracts/multivault/utils/Ownable.sol
everscale/contracts/bridge/interfaces/alien-token-merge/IMergePool.sol
everscale/contracts/utils/Delegate.sol
everscale/contracts/bridge/interfaces/IProxy.sol
everscale/contracts/utils/TransferUtils.sol
ethereum/contracts/multivault/MultiVault.sol
everscale/contracts/dao/structures/ProposalSates.sol
everscale/contracts/bridge/event-contracts/token-transfer/TokenTransferEthereumEvent.sol
everscale/contracts/bridge/interfaces/event-contracts/IEthereumEvent.sol
ethereum/contracts/bridge/StakingRelayVerifier.sol
everscale/contracts/bridge/interfaces/IProxyTokenTransferConfigurable.sol
everscale/contracts/dao/structures/ProposalConfigurationStructure.sol
ethereum/contracts/multivault/interfaces/IMultiVaultToken.sol
ethereum/contracts/utils/ReentrancyGuard.sol
everscale/contracts/staking/Encoder.sol
everscale/contracts/staking/Election.sol
everscale/contracts/bridge/interfaces/IStaking.sol
ethereum/contracts/multivault/utils/ReentrancyGuard.sol
ethereum/contracts/utils/Initializable.sol
everscale/contracts/bridge/interfaces/multivault/IProxyMultiVaultNative.sol
ethereum/contracts/multivault/proxy/TransparentUpgradeableProxy.sol
everscale/contracts/bridge/interfaces/multivault/IMultiVaultEVMEventAlien.sol
everscale/contracts/staking/interfaces/IElection.sol
ethereum/contracts/multivault/interfaces/IEverscale.sol
everscale/contracts/staking/base/StakingUpgradable.sol
everscale/contracts/dao/interfaces/IStakingAccount.sol
everscale/contracts/bridge/Bridge.sol
everscale/contracts/bridge/interfaces/event-configuration-contracts/IEthereumEventConfiguration.sol
everscale/contracts/bridge/Connector.sol
ethereum/contracts/utils/Token.sol
everscale/contracts/bridge/interfaces/IRound.sol
ethereum/contracts/multivault/interfaces/IBridge.sol
ethereum/contracts/multivault/proxy/ProxyAdmin.sol
ethereum/contracts/multivault/interfaces/IERC20Metadata.sol
everscale/contracts/bridge/interfaces/IBridge.sol
everscale/contracts/bridge/interfaces/IEventNotificationReceiver.sol
everscale/contracts/bridge/factory/EverscaleEventConfigurationFactory.sol
everscale/contracts/bridge/factory/EthereumEventConfigurationFactory.sol
everscale/contracts/bridge/event-contracts/multivault/MultiVaultEVMEventNative.sol
everscale/contracts/staking/interfaces/IStakingPool.sol
ethereum/contracts/utils/Cache.sol
everscale/contracts/dao/interfaces/IUpgradableByRequest.sol
ethereum/contracts/multivault/proxy/ERC1967Proxy.sol
everscale/contracts/dao/Proposal.sol
ethereum/contracts/multivault/proxy/ERC1967Upgrade.sol
everscale/contracts/dao/libraries/Gas.sol
everscale/contracts/staking/libraries/PlatformTypes.sol
everscale/contracts/bridge/event-contracts/dao/DaoEthereumActionEvent.sol
everscale/contracts/staking/interfaces/IStakingDao.sol
everscale/contracts/bridge/alien-token/AlienTokenWalletUpgradeable.sol
everscale/contracts/bridge/interfaces/legacy/ILegacyBurnTokensCallback.sol
everscale/contracts/bridge/interfaces/event-configuration-contracts/IBasicEventConfiguration.sol
everscale/contracts/utils/cell-encoder/StakingCellEncoder.sol
everscale/contracts/utils/Platform.sol
everscale/contracts/dao/interfaces/IDaoRoot.sol
everscale/contracts/bridge/event-contracts/multivault/MultiVaultEverscaleEventAlien.sol
everscale/contracts/bridge/event-contracts/staking/StakingTonEvent.sol
everscale/contracts/utils/cell-encoder/TokenCellEncoder.sol
everscale/contracts/bridge/event-contracts/multivault/MultiVaultEverscaleEventNative.sol
everscale/contracts/staking/interfaces/IUserData.sol
everscale/contracts/bridge/proxy/ProxyTokenTransfer.sol
ethereum/contracts/multivault/interfaces/proxy/draft-IERC1822.sol
ethereum/contracts/utils/ChainId.sol
everscale/contracts/dao/interfaces/IUpgradable.sol
everscale/contracts/bridge/interfaces/multivault/IProxyMultiVaultAlien_V3.sol
everscale/contracts/dao/interfaces/IProposer.sol
everscale/contracts/bridge/proxy/ProxyMultiVaultNative.sol
everscale/contracts/bridge/event-configuration-contracts/EthereumEventConfiguration.sol

Part of Venombridge’s security record

Venombridge

Audits1 audit by 1 firmLast audit Nov 2022, by CertiK.

Critical findingsNo open critical findingsIn 1 report.

Open Venombridge’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us