Transparency, safety, and security have always been core to the principal values of Kepler DAO to ensure the highest level of confidence and safety for our community, investors, and stakeholders. Our smart contracts have been developed with the utmost attention to detail to ensure reliable functionality and the highest protection of linked assets. As part of this commitment, we have engaged 0xGuard, a leading smart contract auditor, to perform an independent audit of Kepler’s smart contracts.
The full audit report can be found here: 0xGuard Audit
Smart Contract Audit Report Summary
0xGuard verifies a protocol’s security by performing the below steps:
- Initial code review and familiarization
- Code analysis (manual and automatic)
- Identifying vulnerabilities that have been found
- Evaluation of results
- Gas optimization and compliance
- Hands-on testing
After completing the initial audit, the 0xGuard team has identified 6 high, 14 medium, and 5 low severity issues. These highlighted concerns mainly involve issues regarding excessive owner rights and some edge cases not being handled properly. An important point to note here is that these issues are present in the base code of OHM, and thus are inherent in every OHM fork.
Nevertheless, every single one of these issues was addressed and dealt with accordingly by the Kepler team before the second and final 0xGuard audit.
The detailed first audit evaluation can be found here
The final audit report is an extension of the first audit, and can be summarized as follows:
Fixed Issues
Issues related to the bonding contracts, mostly edge cases that could only trigger on very rare occasions, were all fixed. This includes all high severity issues and most of the medium severity bond contract-related concerns raised. We can now be confident that the bonding mechanism and related operations are secured and free of potential bugs.
An issue in StakingDistributor contract where a gas limit issue could arise in the far future due to the indexing function has been fixed. The issue with token amount calculation in the wTROVE contract has also been improved to prevent issues when wrapping and unwrapping TROVE.
Partially Fixed Issues
Out of all the issues that have not been fully fixed, only a medium severity issue related to ‘Wrong totalDebt calculation’ requires some added attention. This issue arises in situations when the current debt is not updated before checking the requirements for changing the vesting term of a bond, resulting in the underestimation of the total debt value. However, this update actually happens on every deposit, which is a frequent event. Furthermore, the concerned function is only owner accessible, located behind the Policy multi-sig. Thus the scope of error is insignificant here. Still, the team is committed to fixing this issue when the smart contract is deployed.
Acknowledged Issues
A recurring issue raised was in regards to the Excessive Owner Rights. The KeplerERC20, Staking, Bonding, and Treasury have owner-accessible functions that can affect the functioning of the protocol. There is no easy and permanent solution to this rights issue as a level of allowance is required to improve and adjust the smart contract as needed in the future. The team acknowledges this but has implemented a smart solution by having a multisig wallet as the owner of all these contracts. Apart from the DAO multisig, Kepler will also have a Treasury multisig wallet and a Policy multisig wallet:
· The Treasury multisig wallet will be the owner of the Treasury, Staking, and KeplerERC20 contracts, which are critical for the functioning of the protocol.
· The Policy multisig wallet will be the Bonding contracts’ owner, thus controlling the bond parameters for every bond.
Additional issues are raised that mostly fall under medium or low severity levels, which are edge cases like possible underflow error and gas optimization function. These minor issues are present in functions that are owner-accessible only. To ensure maximum security, the owner of these contracts will always be a multisig wallet, which will prevent any one-off mistakes and abuse from any one party.
Overall, the 0xGuard audit has covered the following areas within the Kepler DAO smart contracts:
All checked areas have passed the audit, and the vulnerabilities have been fixed by the Kepler DAO team. This is not the final audit for Kepler and the team is committed to work with auditors long term to ensure the safety and security of Kepler DAO moving forward.
