Zogi Labs - Bezoge

CertiK6 Dec 2022Files named in the report

CertiK reviewed Magical Blocks (Zogi Labs - Bezoge) on 6 Dec 2022: 8 findings, 0 critical; 2 marked fixed, 5 acknowledged, 1 open.

No open critical findings

Open the report Open Magical Blocks’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings8

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	3	0
Medium	0	2	1
Low	1	0	1

HighCentralization Risks in Zogi.solAcknowledged

In the contract `ZOGI` the role `_owner` has authority over the functions shown in the diagram below. ![](https://accelerator-tasks-prod.acc.corp.certik.com/375ba8d85e5d42bdb31708377a231bbf/diagrams/centralization_Zogi-ZOGI-_owner.svg) The role `_owner` also has authority over the function `transferFrom()` to transfer the assets from the users who are on the blacklist. The role `_admins` has authority over the function `mint()` to mint any amount of tokens to anyone. Any compromise to the privileged account may allow the hacker to take advantage of this authority.

HighCentralization Risks in ZogiBridge.solAcknowledged

In the contract `ZogiBridge` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority. ![](https://accelerator-tasks-prod.acc.corp.certik.com/375ba8d85e5d42bdb31708377a231bbf/diagrams/centralization_ZogiBridge-ZogiBridge-_owner.svg)

HighCentralized Control of Contract UpgradeAcknowledged

ZogiBridge and Conversion are upgradeable contracts, the owner can upgrade the contract without the community's commitment. If an attacker compromises the account, he can change the implementation of the contract and drain tokens from the contract.

MediumCross chain swap dependenciesAcknowledged

The cross-chain data are not managed in the contract, it could be a message server hosted by the owner or an intermediate 3rd party application. The scope of the audit treats the above-mentioned application entities as black boxes and assumes their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. If the off-chain data is not managed properly, the user deposits tokens into the source chain, but not be able to redeem the correct token amount from the target chain.

MediumLack of reasonable boundaryAcknowledged

The variable `bridgeFeePercentage` does not have a reasonable boundary, so it can be given arbitrarily values after deploying.