Live
Ends in 25 days

MANTRA Chain

Bringing the world’s financial ecosystem onchain

  • Start date29 Nov 8:00 PM UTC
  • End date6 Jan 8:00 PM UTC
  • Total awards$60,000 in USDC
  • Durationabout 1 month

MANTRA Chain audit details

  • Total Prize Pool: $60,000 in USDC
    • HM awards: $47,800 in USDC
    • QA awards: $2,000 in USDC
    • Judge awards: $5,800 in USDC
    • Validator awards: $3,900 in USDC
    • Scout awards: $500 in USDC
  • Read our guidelines for more details
  • Starts November 29, 2024 20:00 UTC
  • Ends January 6, 2025 20:00 UTC

Note re: risk level upgrades/downgrades

Two important notes about judging phase risk adjustments:

  • High- or Medium-risk submissions downgraded to Low-risk (QA)) will be ineligible for awards.
  • Upgrading a Low-risk finding from a QA report to a Medium- or High-risk finding is not supported.

As such, wardens are encouraged to select the appropriate risk level carefully during the submission phase.

Publicly Known Issues

Note for C4 wardens: Anything included in this Publicly Known Issues section is considered a publicly known issue and is ineligible for awards.

Issues directly related to cosmos-sdk, IBC, cosmwasm and their dependencies (comet-bft) will not be within the scope of this audit. Basically if it is a issue affecting all cosmos chains of the same versions then it should be out of scope.

However, if the issue arise from the custom code we made on our cosmos-sdk, or if the issues are directly affecting behavior of our custom modules, or if our custom modules are causing issues in the base cosmos modules (includes cosmwasm and IBC) then they should be included in the scope.

Overview

Mantrachain is a global real-world assets platform built on blockchain technology. It leverages advanced blockchain features to facilitate the tokenization and trading of real-world assets.

Features:

  • Real-world asset tokenization
  • Advanced blockchain technology integration
  • Multi-token support for transaction fees
  • Custom fee market implementation
  • Cosmos SDK-based architecture

Links


Scope

See scope.txt

Filecode
api/osmosis/tokenfactory/v1beta1/tx.pulsar.go6442
x/tokenfactory/types/tx.pb.go3431
api/osmosis/tokenfactory/v1beta1/query.pulsar.go3145
api/mantrachain/xfeemarket/v1/tx.pulsar.go2334
x/tokenfactory/types/query.pb.go1677
x/xfeemarket/types/tx.pb.go1304
api/osmosis/tokenfactory/v1beta1/genesis.pulsar.go1132
api/mantrachain/xfeemarket/v1/genesis.pulsar.go1028
app/app.go960
x/xfeemarket/post/mocks/mock_bank_keeper.go920
api/mantrachain/tax/v1/tx.pulsar.go883
api/mantrachain/xfeemarket/v1/query.pulsar.go760
api/mantrachain/tax/v1/query.pulsar.go754
x/xfeemarket/post/fee_test.go682
x/tokenfactory/types/genesis.pb.go662
api/osmosis/tokenfactory/v1beta1/params.pulsar.go654
api/osmosis/tokenfactory/params.pulsar.go649
api/mantrachain/tax/v1/params.pulsar.go593
x/tax/types/tx.pb.go581
x/xfeemarket/types/genesis.pb.go575
api/osmosis/tokenfactory/module/v1/module.pulsar.go568
x/xfeemarket/types/query.pb.go483
x/tax/types/query.pb.go481
cmd/mantrachaind/cmd/testnet.go471
api/mantrachain/tax/v1/genesis.pulsar.go458
api/osmosis/tokenfactory/v1beta1/authorityMetadata.pulsar.go446
api/mantrachain/xfeemarket/module/v1/module.pulsar.go445
api/mantrachain/tax/module/v1/module.pulsar.go442
x/tax/types/params.pb.go426
x/tokenfactory/types/v1beta1/params.pb.go403
x/tokenfactory/types/params.pb.go401
x/tokenfactory/types/query.pb.gw.go376
api/mantrachain/xfeemarket/v1/params.pulsar.go369
api/osmosis/tokenfactory/v1beta1/tx_grpc.pb.go329
x/tokenfactory/types/authorityMetadata.pb.go321
app/test_helpers.go308
x/xfeemarket/post/suite/suite.go302
x/tax/types/genesis.pb.go296
x/xfeemarket/types/params.pb.go264
x/tokenfactory/types/msgs.go251
x/tokenfactory/client/cli/tx.go224
x/tokenfactory/keeper/msg_server.go216
api/osmosis/tokenfactory/v1beta1/query_grpc.pb.go185
app/export.go176
cmd/mantrachaind/cmd/commands.go171
x/tax/module/genesis_test.go169
x/xfeemarket/post/mocks/mock_feemarket_keeper.go154
api/mantrachain/xfeemarket/v1/tx_grpc.pb.go149
x/xfeemarket/module/module.go149
x/tokenfactory/module.go145
x/tax/module/module.go143
x/xfeemarket/post/fee.go141
tests/connect/connect_integration_test.go128
x/tokenfactory/client/cli/query.go126
x/tokenfactory/keeper/before_send.go108
app/oracle.go107
x/tax/types/query.pb.gw.go107
x/xfeemarket/types/query.pb.gw.go107
app/queries/queries.go99
x/tax/types/genesis_test.go93
x/tax/keeper/msg_update_params_test.go87
app/ante.go85
cmd/mantrachaind/cmd/root.go85
x/tokenfactory/keeper/createdenom.go82
x/tokenfactory/keeper/bankactions.go81
x/tokenfactory/types/params.go79
x/xfeemarket/module/simulation.go79
api/mantrachain/tax/v1/query_grpc.pb.go77
api/mantrachain/tax/v1/tx_grpc.pb.go77
api/mantrachain/xfeemarket/v1/query_grpc.pb.go77
x/tax/keeper/keeper.go75
x/tax/types/params.go74
app/genesis.go66
x/tokenfactory/keeper/keeper.go66
x/tokenfactory/keeper/genesis.go59
x/xfeemarket/keeper/msg_update_params_test.go57
x/xfeemarket/keeper/keeper.go52
testutil/nullify/nullify.go49
app/params/config.go46
testutil/keeper/tax.go46
x/xfeemarket/module/genesis.go46
testutil/keeper/xfeemarket.go45
x/tokenfactory/types/denoms.go45
x/tokenfactory/types/genesis.go44
x/xfeemarket/keeper/msg_server_fee_denom.go44
x/tax/keeper/msg_update_params.go43
x/tax/module/autocli.go42
x/xfeemarket/module/autocli.go41
cmd/mantrachaind/cmd/config.go38
x/tax/types/msg_update_params.go38
app/params/weights.go37
x/tax/module/simulation.go36
x/tokenfactory/keeper/admins.go36
x/tokenfactory/types/codec.go36
app/params/proto.go35
x/xfeemarket/types/genesis_test.go35
x/tokenfactory/keeper/grpc_query.go33
x/tokenfactory/types/keys.go32
app/test_support.go31
x/tokenfactory/types/expected_keepers.go30
x/xfeemarket/keeper/resolver.go29
x/tokenfactory/types/tx.go28
testutil/network/network.go27
x/tax/module/abci.go27
x/xfeemarket/types/message_upsert_fee_denom.go27
app/post_handler.go26
x/tokenfactory/keeper/params.go24
app/encoding.go23
x/tax/keeper/query_params.go23
x/xfeemarket/types/genesis.go23
x/tokenfactory/keeper/creators.go22
x/xfeemarket/keeper/query_params.go22
x/xfeemarket/module/genesis_test.go22
x/xfeemarket/simulation/remove_fee_denom.go22
x/xfeemarket/simulation/upsert_fee_denom.go22
x/tokenfactory/types/before_send.go20
x/tokenfactory/types/errors.go19
x/xfeemarket/keeper/msg_update_params.go19
x/tax/module/genesis.go18
x/xfeemarket/post/expected_keepers.go18
x/xfeemarket/types/codec.go18
x/xfeemarket/types/keys.go18
x/tax/keeper/query_params_test.go17
x/xfeemarket/keeper/query_params_test.go17
x/xfeemarket/types/default_resolver.go17
x/xfeemarket/types/message_remove_fee_denom.go17
cmd/mantrachaind/main.go16
x/xfeemarket/types/expected_keepers.go16
app/wasm.go15
x/tokenfactory/types/events.go15
x/tokenfactory/types/authorityMetadata.go13
app/params/encoding.go12
x/tax/types/codec.go12
x/tax/types/expected_keepers.go12
x/xfeemarket/simulation/helpers.go12
x/tax/keeper/msg_server.go11
x/tax/keeper/query.go11
x/tax/types/keys.go11
x/xfeemarket/keeper/msg_server.go11
x/xfeemarket/keeper/query.go11
app/proposals_whitelisting.go10
testutil/sample/sample.go10
tools/tools.go10
x/tax/types/genesis.go10
x/xfeemarket/types/params.go10
client/docs/statik/statik.go8
x/tax/types/errors.go8
x/xfeemarket/types/errors.go7
x/tax/types/events.go5
x/tokenfactory/types/constants.go3
scripts/ci-goreleaser/goreleaser.go2
app/params/doc.go1
client/docs/statik/init.go1
x/tax/types/types.go1
SUM:42898

Scoping Q & A

General questions

QuestionAnswer
ERC20 used by the protocolN/A
ERC721 used by the protocolN/A
ERC777 used by the protocolN/A
ERC1155 used by the protocolN/A
Chains the protocol will be deployed onMANTRA Chain

External integrations (e.g., Uniswap) behavior in scope:

QuestionAnswer
Enabling/disabling fees (e.g. Blur disables/enables fees)No
Pausability (e.g. Uniswap pool gets paused)No
Upgradeability (e.g. Uniswap gets upgraded)No

EIP compliance checklist

N/A

Additional context

Main invariants

Tokenfactory

  • The user that created a token is the token admin of that token
  • Only token admin can force transfer and mint tokens

Attack ideas (where to focus for bugs)

We have a custom tokenfactory module. We are concerned to see if this module can be exploited to have unintended behavior such as:

  • minting by users not the token admin
  • force transfer of tokens not done by token admin

All trusted roles in the protocol

Mostly permissionless.

Some functionalities are only invoked by governance through proposals and voting.

Describe any novel or unique curve logic or mathematical models implemented in the contracts:

N/A

Running tests

git clone --recurse https://github.com/code-423n4/2024-11-mantra.git cd 2024-11-mantra go mod tidy make install make test

Miscellaneous

Employees of MANTRA and employees' family members are ineligible to participate in this audit.

Code4rena's rules cannot be overridden by the contents of this README. In case of doubt, please check with C4 staff.