VIS-DEI Security Audit Report v3

VIS-DEI Token Security Audit Report

Are Your Funds Safe?

Our expert team at Callisto Network has conducted an in-depth security audit of the VIS-DEI smart contract. This audit aims to ensure the security of your funds by identifying and assessing any potential vulnerabilities. Here, we present our findings:

Total Finding(s)

0 - Hight severity issue(s)

0 - Medium severity issue(s)

0 - Low severity issue(s)

0 note(s)

4 owner privilege(s)

Executive Summary

This report presents the results of the security audit conducted by the Callisto Network Security Department on the VIS-DEI smart contracts in March 2024. It analyzes the contract’s security posture in-depth and highlights any identified vulnerabilities.

1. Scope of the Audit

Commit: 4f036260dce9a439c16afcb3dfd298535483e2c7

Generic:

Staking:

Token:

Vesting:

VestingFactory.sol

2. Audit Findings

Our audit reported a total of 0 finding(s), categorized as follows:

0 high-severity issue(s).
0 medium severity issue(s).
0 low-severity issue(s).

In addition to these findings, our audit identified 4 additional points, detailed in the following sections:

0 note(s).
4 owner privilege(s).

No critical security issues were found.

2.1 Owner Privileges

[bsf-info-box icon_type=”custom” icon_img=”id^11677|url^https://callisto.network/wp-content/uploads/2023/04/Mask-Group-6.png|caption^null|alt^null|title^Mask Group 6|description^null” img_width=”20″ icon_animation=”fadeIn” title=”Severity:” el_class=”mos_flex”]Owner Privileges.[/bsf-info-box][bsf-info-box icon_type=”custom” icon_img=”id^11678|url^https://callisto.network/wp-content/uploads/2023/04/Mask-Group-7.png|caption^null|alt^null|title^Mask Group 7|description^null” img_width=”20″ icon_animation=”fadeIn” title=”Description:”]

Any owner can Pause/unpause Staking and Launchpad contracts.
Set interest in a Staking contract.
Withdraw tokens from the Staking contract (including users’ deposits).
Withdraw tokens from Launchpad contract.

[/bsf-info-box]

3. Security Practices

Open-Source Contract: The contract's source code should be accessible for public scrutiny.

Bug Bounty Program: Initiating a bug bounty program post-audit for comprehensive security validation is recommended.

Public testing: The contract should undergo public testing to detect unforeseen bugs or issues.

Automated Anomaly Detection System: Not Implemented. Establishing a simple anomaly detection algorithm to monitor and respond to unusual activities is advised. For instance, the contract must temporarily suspend deposits if a large withdrawal is detected until approval by the contract owner or community.

Multi-signature Owner Account: A multi-signature setup for owner accounts is recommended for additional security layers.

Standard ERC20-Related Issues: Implemented. It is known that a smart contract, even if not designed to receive or hold tokens, can still inadvertently receive ERC20-token deposits, without the ability to reject them. Thus, it's recommended to incorporate a function that allows for the extraction of any number of such unintended tokens from the contract.

Crosschain Address Collisions: Transactions can be mistakenly sent to a contract's address on a different chain (ETH, ETC, CLO, etc..). To mitigate this, deploying a "mock contract" that allows token withdrawal or prevents fund deposits at the address is recommended. Please note native blockchain coin deposits can be rejected, but ERC20 token deposits cannot. The following source code can be used as a mock contract: extractor contract source code. When deploying a new contract using CREATE (0xf0) opcode, the new contract's address follows this scheme keccak256(rlp([sender, nonce])). Thus, the same address used on the main chain should be used to deploy the mock contract, with the transaction nonce matching that on the original chain. For example, if your main contract (address 0x010101) was deployed in your 2021st transaction, you need to increase your nonce of address 0x010101 to 2020 on the chain where your mock contract will be deployed. Then, your 2021st transaction can deploy your mock contract, which will share the same address as your mainnet contract.

4. Conclusion

The audited smart contract can be deployed. No security issues were found during the audit.

Users should pay attention to owners’ privileges.

Staking contract do not guarantee users that they will be able to withdraw their deposits if tokens for interest are not added by the owner.

It is recommended to adhere to the security practices described in pt. 4 of this report to ensure the contract’s operability and prevent any issues that are not directly related to the code of this smart contract.

5. Previous Audit Reports

About Callisto Security

Callisto Security conducted over 330 smart contract audits across platforms like Ethereum, Ethereum Classic, and EOS. In addition to our audits, we’ve contributed to developing the ERC 223 token standard and CallistoNFT standard, enhancements over existing standards that address flaws and offer new capabilities, further establishing us as industry leaders in crypto-security.

Trust The Blockchain, Audit Your Smart Contracts.

Callisto Evolution

Fushuma On-chain Democracy

Philosophy of Decentralization - Blueprint

Fushuma Tokenomics

Cold Staking

ERC-223 Token Standard

Callisto NFT Standard

Callisto Network Mining

Network Explorer

DApps

Wallets

Callistonians NFT Collection

Callisto Network Essentials

Callisto Progress Tracker

Testnet Tools

VIS-DEI Token Security Audit Report

Are Your Funds Safe?