Phi audit details

• Total Prize Pool: $30,000 in USDC
  • HM awards: $24,000 in USDC
  • QA awards: $900 in USDC
  • Judge awards: $2,800 in USDC
  • Validator awards: $1,800 USDC
  • Scout awards: $500 in USDC
• Read our guidelines for more details
• Starts August 22, 2024 20:00 UTC
• Ends September 3, 2024 20:00 UTC

Automated Findings / Publicly Known Issues

The 4naly3er report can be found here.

Note for C4 wardens: Anything included in this Automated Findings / Publicly Known Issues section is considered a
publicly known issue and is ineligible for awards.

1. updateArtSettings allows setting the startTime to a past timestamp, potentially opening the minting window earlier
   than intended
2. Setting sellRoyalty higher than buyRoyalty may reduce market demand possibly leading to decreased liquidity
3. Lack of upper bound check for mintFee
4. User can claim multiple NFT (not check claimed status)
5. creatorFee to be always zero when supply == 0
6. Solady ECDSA.recover(), which does not reject malleable signature. For this issue, we use expiresIn
7. The credMerkleRoot[credChainId][credId] stores the merkleRootHash, but there is no way to update the merkleRootHash.
8. OZ EnumerableMap is not gas efficiency

Overview

Phi Protocol is an open credentialing protocol to help users form, visualize, showcase their onchain identity. It
incentivizes individuals to index blockchain transaction data as onchain credential blocks, curate them, host the
verification process, and mint onchain credential contents.

Links

• Previous audits: https://github.com/code-423n4/2024-08-phi/tree/main/docs/audit
• Documentation: https://docs.philand.xyz/explore-phi
• Website: https://phiprotocol.xyz/
• X/Twitter: https://x.com/phi_xyz
• Discord: https://discord.gg/phi

---

Scoping Q & A

General questions

ERC20 token behaviors in scope

External integrations (e.g., Uniswap) behavior in scope

EIP compliance checklist

Additional context

Main invariants

• Our demo for audit: https://base-sepolia.terminal.phiprotocol.xyz/
• Creating CREDs with identical conditions is possible, therefore buying up shares has little significance.

Attack ideas (where to focus for bugs)

1. Security: Identify and mitigate vulnerabilities to prevent exploits and attacks.

2.a. Function Reliability: Ensure the contract behaves consistently under various conditions.

2.b. Function Correctness: Ensure the smart contract logic correctly implements the intended functionality without
errors.

3. Gas Efficiency

---

Security Concerns - Access Control, Signature Verification, Reply Protection, Data integrity

• Does the access control mechanism correctly restrict access to sensitive functions?
• Can the signature verification function correctly verify the required signatures?
• Does the function handling signature proofs properly reject invalid or malicious proofs?

Functional Reliability/Correctness Concerns

• Are there any issues arising when claiming multiple amounts or performing batch processing?
• Is there any unnecessary accumulation of ETH in the contract
• Does the contract emit all necessary events correctly and include appropriate data?
• Are there any potential issues or concerns when utilizing different bonding curves with CRED
• Are there any potential issues with emitting events or executing functions when using Decent or relayer protocols?
• Does the contract have proper error handling and revert statements for invalid inputs, unauthorized access, and other
  potential failure scenarios?
• Is it possible to intentionally target a halt when using loops?

Gas Efficiency: Verify that the contract performs optimally without unnecessary gas consumption.

• Can the contract be optimized for gas efficiency, particularly in loops and storage access patterns?

All trusted roles in the protocol

Describe any novel or unique curve logic or mathematical models implemented in the contracts

• Docs: https://docs.philand.xyz/explore-phi/phi-protocol/phi-protocol-rewards/curator-reward
• Also, You can check our Share price curve (Google Doc)

Running tests

git clone --recurse https://github.com/code-423n4/2024-08-phi.git
git 2024-08-phi
git submodule update --init --recursive
bun install
forge test -vvv

• forge coverage's output:

Scope

See scope.txt

Files in scope

Files out of scope

See out_of_scope.txt

Miscellaneous

Employees of PHI and employees' family members are ineligible to participate in this audit.

Code4rena's rules cannot be overridden by the contents of this README. In case of doubt, please check with C4 staff.