Synthetix USDC18 Smart Contract Audit

</nav>
<article class="report">
<h1 id="introduction">Introduction</h1>
<p>iosiro was commissioned by Synthetix to perform a smart contract audit of their USDC18 ERC-20 token contract. One auditor conducted the audit on 26 November 2024, using 1 audit day.</p>
<h4 id="overview">Overview</h4>
<p>The USDC18 contract is an ERC-20 wrapper used to upscale USDC to 18 decimals. This contract was written to allow USDC to be used as margin in Synthetix v2x on Optimism and Ethereum mainnet.</p>
<p>The audit found one low-risk and two informational issues. The low-risk issue relates to precision loss and could cause the contract's USDC balance to diverge from its USDC18 supply over time. Such a divergence, however, is expected to be negligible, and thus the issue was closed.</p>
<p>The two informational issues related to secure coding practices and were resolved during the audit.</p>
<table class="findings-count">
<thead>
<tr>
<th> </th>
<th>Critical</th>
<th>High</th>
<th>Medium</th>
<th>Low</th>
<th>Informational</th>
</tr>
</thead>
<tbody>
<tr>
<td>Open</td>
<td>0</td>
<td>0</td>
<td>0</td>
<td>0</td>
<td>0</td>
</tr>
<tr>
<td>Resolved</td>
<td>0</td>
<td>0</td>
<td>0</td>
<td>0</td>
<td>2</td>
</tr>
<tr>
<td>Closed</td>
<td>0</td>
<td>0</td>
<td>0</td>
<td>1</td>
<td>0</td>
</tr>
</tbody>
</table>
<h4 id="scope">Scope</h4>
<p>The assessment focused on the source file listed below, with all other files considered out of scope. Any out-of-scope code interacting with the assessed code was presumed to operate correctly without introducing functional or security vulnerabilities.</p>
<ul>
<li><strong>Project name:</strong> usdc_18</li>
<li><strong>Initial audit commit:</strong> <a href="https://github.com/0xMithrandir/usdc_18/tree/e70fb770adec22c8c8e42b68b22abd65e4c35355">e70fb77</a></li>
<li><strong>Final review commit:</strong> <a href="https://github.com/0xMithrandir/usdc_18/tree/aae7d9a0bc010b889bb3eb3e9f22871af9d94d17">aae7d9a</a></li>
<li><strong>Files:</strong> USDC.sol</li>
</ul>
<h1 id="disclaimer">Disclaimer</h1>
<p>This report aims to provide an overview of the assessed smart contracts' risk exposure and a guide to improving their security posture by addressing identified issues. The audit, limited to specific source code at the time of review, sought to:</p>
<ul>
<li>Identify potential security flaws.</li>
<li>Verify that the smart contracts' functionality aligns with their documentation.</li>
</ul>
<p>Off-chain components, such as backend web application code, keeper functionality, and deployment scripts were explicitly not in-scope for this audit.</p>
<p>Given the unregulated nature and ease of cryptocurrency transfers, operations involving these assets face a high risk from cyber attacks. Maintaining the highest security level is crucial, necessitating a proactive and adaptive approach that accounts for the experimental and rapidly evolving nature of blockchain technology. To encourage secure code development, developers should:</p>
<ul>
<li>Integrate security throughout the development lifecycle.</li>
<li>Employ defensive programming to mitigate the risks posed by unexpected events.</li>
<li>Adhere to current best practices wherever possible.</li>
</ul>
<h1 id="methodology">Methodology</h1>
<p>The audit was conducted using the techniques described below.</p>
<dl>
<dt>Code review</dt>
<dd>The source code was manually inspected to identify potential security flaws. Code review is a useful approach for detecting security flaws, discrepancies between the specification and implementation, design improvements, and high-risk areas of the system.</dd>
<dt>Dynamic analysis</dt>
<dd>The contracts were compiled, deployed, and tested in a test environment, both manually and through the test suite provided. Dynamic analysis was used to identify additional edge cases, confirm that the code was functional, and to validate the reported issues.</dd>
<dt>Automated analysis</dt>
<dd>Automated tooling was used to detect the presence of various types of security vulnerabilities. Static analysis results were reviewed manually and any false positives were removed. Any true positive results are included in this report.</dd>
</dl>
<h1 id="audit-findings">Audit findings</h1>
<p>The table below provides an overview of the audit's findings. Detailed write-ups are provided below.</p>
<table class="findings">
<thead>
<tr>
<th>ID</th>
<th>Issue</th>
<th>Risk</th>
<th>Status</th>
</tr>
</thead>
<tbody>
<tr>
<td><a href="#IO-SNX-U18-001">IO-SNX-U18-001</a></td>
<td>Precision loss in withdraw function</td>
<td class="rating-low">Low</td>
<td class="status-closed">Closed</td>
</tr>
<tr>
<td><a href="#IO-SNX-U18-002">IO-SNX-U18-002</a></td>
<td>Missing address validation</td>
<td class="rating-informational">Informational</td>
<td class="status-resolved">Resolved</td>
</tr>
<tr>
<td><a href="#IO-SNX-U18-003">IO-SNX-U18-003</a></td>
<td>Unnecessary use of nonReentrant</td>
<td class="rating-informational">Informational</td>
<td class="status-resolved">Resolved</td>
</tr>
</tbody>
</table>
<p>Each issue identified during the audit has been assigned a risk rating. The rating is determined based on the criteria outlined below.</p>
<dl>
<dt>Critical risk</dt>
<dd>The issue could result in the theft of funds from the contract or its users.</dd>
<dt>High risk</dt>
<dd>The issue could result in the loss of funds for the contract owner or its users.</dd>
<dt>Medium risk</dt>
<dd>The issue resulted in the code being dysfunctional or the specification being implemented incorrectly.</dd>
<dt>Low risk</dt>
<dd>A design or best practice issue that could affect the ordinary functioning of the contract.</dd>
<dt>Informational</dt>
<dd>An improvement related to best practice or a suboptimal design pattern.</dd>
</dl>
<p>In addition to a risk rating, each issue is assigned a status:</p>
<dl>
<dt>Open</dt>
<dd>The issue remained present in the code as of the final commit reviewed and may still pose a risk.</dd>
<dt>Resolved</dt>
<dd>The issue was identified during the audit and has since been satisfactorily addressed, removing the risk it posed.</dd>
<dt>Closed</dt>
<dd>The issue was identified during the audit and acknowledged by the developers as an acceptable risk without actioning any change.</dd>
</dl>
<a name="IO-SNX-U18-001"></a><h2 id="io-snx-u18-001-precision-loss-in-withdraw-function" class="break-before"><strong>IO-SNX-U18-001</strong> Precision loss in withdraw function</h2>
<table class="metadata">

<tbody>
<tr>
<td class="rating-low">Low</td>
<td class="status-closed">Closed</td>
<td><a href="https://github.com/0xMithrandir/usdc_18/blob/e70fb770adec22c8c8e42b68b22abd65e4c35355/src/USDC18.sol#L51">USDC18.sol#L51</a></td>
</tr>
</tbody>
</table>
<p>When calling the <code>withdraw()</code> function, there’s a potential precision loss of any value less than 6 decimals. This error can accumulate over time and could result in a discrepancy between the total supply of USDC18 and the USDC stored in the contract (i.e. <code>USDC18.totalSupply()</code> ≠ <code>USDC18.getUSDCBalance()</code> ).</p>
<h3 id="recommendation">Recommendation</h3>
<p>This issue may be mitigated by changing the amount burned on withdraw from a user-supplied value to either an amount that is modded by the <code>DECIMAL_CONVERTER</code> or the downscaled value rescaled back up to an 18 decimal value.</p>
<p>However, this might not be necessary as the amount should be fairly negligible.</p>
<h3 id="client-response">Client response</h3>
<p>The discrepancy between the contract's USDC balance and total supply of USDC18 is expected to be negligible.</p>
<a name="IO-SNX-U18-002"></a><h2 id="io-snx-u18-002-missing-address-validation" class="break-before"><strong>IO-SNX-U18-002</strong> Missing address validation</h2>
<table class="metadata">

<tbody>
<tr>
<td class="rating-informational">Informational</td>
<td class="status-resolved">Resolved</td>
<td><a href="https://github.com/0xMithrandir/usdc_18/blob/e70fb770adec22c8c8e42b68b22abd65e4c35355/src/USDC18.sol#L21">USDC18.sol#L21</a></td>
</tr>
</tbody>
</table>
<p>The constructor could validate <code>USDC.decimals()</code> is non-zero to ensure that a legitimate ERC20 token address is passed in. This would prevent the contract from being bricked on creation.</p>
<h3 id="client-response-1">Client response</h3>
<p>Fixed in <a href="https://github.com/0xMithrandir/usdc_18/commit/aae7d9a0bc010b889bb3eb3e9f22871af9d94d17">aae7d9a</a>.</p>
<a name="IO-SNX-U18-003"></a><h2 id="io-snx-u18-003-unnecessary-use-of-nonreentrant" class="break-before"><strong>IO-SNX-U18-003</strong> Unnecessary use of nonReentrant</h2>
<table class="metadata">

<tbody>
<tr>
<td class="rating-informational">Informational</td>
<td class="status-resolved">Resolved</td>
<td><a href="https://github.com/0xMithrandir/usdc_18/blob/e70fb770adec22c8c8e42b68b22abd65e4c35355/src/USDC18.sol#L29">USDC18.sol#L29</a>, <a href="https://github.com/0xMithrandir/usdc_18/blob/e70fb770adec22c8c8e42b68b22abd65e4c35355/src/USDC18.sol#L46">USDC18.sol#L46</a></td>
</tr>
</tbody>
</table>
<p>The <code>nonReentrant</code> modifier is not necessary for the <code>deposit()</code> and <code>withdraw()</code> functions as there is no way to reenter through these functions.</p>
<h3 id="client-response-2">Client response</h3>
<p>Fixed in <a href="https://github.com/0xMithrandir/usdc_18/commit/aae7d9a0bc010b889bb3eb3e9f22871af9d94d17">aae7d9a</a>.</p>
<h1 id="test-coverage-report">Test coverage report</h1>
<p>The coverage report of the provided tests as on the final day of the audit is given below.</p>
<table>
<thead>
<tr>
<th>File</th>
<th>% Lines</th>
<th>% Statements</th>
<th>% Branches</th>
<th>% Funcs</th>
</tr>
</thead>
<tbody>
<tr>
<td>src/USDC18.sol</td>
<td>94.44% (17/18)</td>
<td>90.91% (20/22)</td>
<td>60.00% (6/10)</td>
<td>80.00% (4/5)</td>
</tr>
</tbody>
</table>

</article>
</main>
</div>

‍