QuillAudits Boosted FooDriver Protocol: Fixed Pricing Rates

The FooDriver Protocol is a decentralized application (dApp) designed to revolutionize the delivery industry by utilizing blockchain technology. It operates as a fully decentralized platform that connects consumers, delivery drivers, and businesses, facilitating seamless transactions through smart contracts.

FooDriver Protocol is Redefining Decentralized Delivery

The FooDriver Protocol aims to reshape the delivery industry by utilizing blockchain technology to create a fully decentralized platform. By connecting consumers, delivery drivers, and businesses through smart contracts, it ensures transparency, trust, and efficiency in every transaction. Unlike traditional delivery platforms, FooDriver operates without intermediaries, allowing users to save on fees and enjoy a more reliable service. With its native token, the protocol offers an incentive-driven ecosystem, benefiting all parties involved. Built on the Polygon blockchain, FooDriver leverages scalability, low transaction fees, and seamless integration to enhance the user experience.

Tackling Security Challenges within FooDriver Protocol

The FooDriver Protocol, like any Web3 application, has faced security concerns such as potential smart contract vulnerabilities and transaction manipulation risks. Our audit delved deep into identifying areas like reentrancy attacks, authorization flaws, and logic errors to ensure the protocol's robustness. By implementing best practices and rigorous testing their smart contracts FooDriverToken, FooDriverRegistry, FooDriverFactory, FooDriverStore,& FooDriverBank; the FooDriver Protocol now offers enhanced security for users, guaranteeing safer and more efficient decentralized delivery services.

FooDriver Protocol’s Journey Through Our Audit Process

1.Information Gathering

• Collected and reviewed all relevant documentation, including whitepaper, technical specifications, and design documents.
   
• Obtained a clear understanding of the FooDriver platform's functionality and intended user interactions.
   
• Discussed client concerns and specific areas of focus for the audit.
   

2. Manual Code Review:

• Conducted a line-by-line review of the smart contract code, focusing on:
  • Vulnerability identification: Searching for known vulnerabilities like reentrancy, front-running, integer overflows, and access control issues, etc.
  • Logic flaws: Identifying inconsistencies or unintended behaviours in the code logic.
  • Solidity best practices: Compliance with secure coding standards and adherence to established guidelines.
     

3.Functional Testing:

• Developed and executed a comprehensive set of test cases covering various user interactions and edge cases.
   
• Leveraged tools like Hardhat and Ganache to deploy and test the smart contract locally.
   

4. Automated Testing:

• Employed static analysis tools like QuillShield to identify vulnerabilities through automated code scanning.
   
• Utilized symbolic execution tools like Mythril to explore various code execution paths and uncover potential attack vectors.
   
• Integrated unit tests are written by the FooDriver team to verify specific contract functions and their behavior.
   

5. Reporting & Remediation:

• Prepared a detailed report outlining all identified vulnerabilities, categorized by severity and potential impact.
   
• Provided clear recommendations for fixing each vulnerability, including code snippets and best practices.
   
• Collaborated with the FooDriver Protocol team to prioritize and address the identified issues.
   
• Conducted additional verification testing after vulnerability fixes were implemented.

QuillAudits' Strategic Approach to FooDriver’s Security Audits

Our approach to auditing FooDriver Protocol involved a combination of threat modeling, a security-first mindset, and extensive testing. We used both white-box and black-box testing methods to ensure a thorough assessment, maintaining transparency and clear communication with the FooDriver Protocol team throughout the process.

Comprehensive Audit Discoveries and Remediation Strategies

The FooDriver Protocol security audit identified several vulnerabilities that attackers could exploit to compromise user accounts, steal sensitive information, and disrupt application functionality:

Our thorough and extensive audit uncovered 10 critical vulnerability, 2 High Severity, 3 Medium-severity issues, and 1 Low and 4 informational findings.

Here is a breakdown of the critical vulnerabilities in audit discoveries and remediation strategies:

Incorrect Rate Accounting Resulting in Excessive Token Minting

• Discovery: The system was incorrectly calculating the number of tokens to be minted for each purchase, causing users to receive 100 times more tokens than intended. The issue stemmed from the system using a 100-to-1 ratio to represent decimal values (e.g., 1% is represented as 100). While this approach works for percentages, it caused miscalculations for whole numbers, like 100%. As a result, when a user bought 100% of the available tokens, the system mistakenly calculated the payout as 100,000 tokens instead of the intended 1,000.
   
• Impact: Users received significantly more tokens than they should have, which could lead to severe inflation or a potential financial drain on the protocol.
   

Missing Token Transfer Validation Allowing Unauthorized Minting:

• Discovery: The purchasePublic and purchasePrivate functions did not validate the return value of the transferFrom function. This flaw meant that even if a token transfer failed, the function would still proceed, resulting in tokens being minted without the corresponding transfer of funds. Additionally, this vulnerability left the contract exposed to issues related to fee-on-transfer tokens, irregular token decimals, and missing return value checks in the releasePayment and refundPayment functions.
   
• Impact: Users could exploit this vulnerability to mint tokens without making any payment, potentially leading to significant financial losses for the project. Fee-on-transfer tokens could also lead to incorrect token balances, and irregular decimals could result in users paying less for more tokens.
   

Inaccurate Token Pricing in FooDriverToken

• Discovery: The supportedTokens array within the FooDriverToken contract contained details about supported tokens, including their rates. If these rates were not updated correctly, users could exploit the system to purchase tokens at a lower price than intended.
   
• Impact: This flaw allowed users to buy tokens for less than their actual value, resulting in financial losses for the project and granting an unfair advantage to early adopters.
   

Missing Gap Variables Leading to Potential Storage Collisions in Upgradeable Contracts

• Discovery: In upgradeable contracts, the absence of gap variables could cause new storage variables to overwrite existing ones, a problem known as a storage collision. This risk increases when additional variables are introduced during contract upgrades without reserving space.
   
• Impact: Storage collisions can lead to incorrect contract behavior, data loss, or even the emergence of security vulnerabilities, potentially causing the protocol to malfunction or be exploited.

Remediation Strategies
 

1. Incorrect Rate Accounting Resulting in Excessive Token Minting:
   • Remediation Strategy: The calculation logic for token minting was carefully reviewed and corrected to handle both percentage and whole number values accurately. The system now properly distinguishes between values represented in the 100-to-1 ratio and whole numbers to prevent inflated minting rates.
      
   • Fix Implemented: Updated the minting logic to correctly handle whole numbers by implementing proper scaling. The calculations were adjusted to ensure that when 100% is purchased, the system correctly issues 1,000 tokens instead of 100,000. Additional validation checks were added to ensure that any future modifications wouldn’t reintroduce this error.
      
2. Missing Token Transfer Validation Allowing Unauthorized Minting:
   • Remediation Strategy: To prevent unauthorized minting, the transferFrom function’s return values were thoroughly validated within both the purchasePublic and purchasePrivate functions. This validation ensures that no tokens are minted unless the transfer completes successfully.
      
   • Fix Implemented: Added checks to confirm the successful execution of the transferFrom function before proceeding with token minting. Additionally, handling for fee-on-transfer tokens and tokens with irregular decimals was integrated to ensure accurate accounting. The releasePayment and refundPayment functions were also updated to include return value checks, ensuring that all transactions are processed correctly.
      
3. Inaccurate Token Pricing in FooDriverToken:
   • Remediation Strategy: The supportedTokens array and the associated rate updates were fortified with mechanisms to ensure accurate and consistent token rate updates. This ensured that users couldn’t exploit outdated or incorrect rates.
      
   • Fix Implemented: Introduced a validation mechanism to monitor and enforce accurate token rate updates within the supportedTokens array. Any attempt to manipulate or bypass the intended rates was restricted, ensuring that the purchase price of tokens always reflected the correct market rate. Regular audits of the rates were also scheduled to maintain accuracy.
      
4. Missing Gap Variables Leading to Potential Storage Collisions in Upgradeable Contracts:
   • Remediation Strategy: To prevent storage collisions in upgradeable contracts, gap variables were introduced to reserve space for future storage variables. This strategy ensured that additional variables added during upgrades would not overwrite existing data.
      
   • Fix Implemented: Implemented gap variables within the contract storage layout, reserving ample space to prevent potential collisions in future upgrades. This solution ensured that even with future modifications, the contract's storage structure would remain intact, maintaining data integrity and security.
      

Impressed by our findings and recommendations, the FooDriver Protocol developers promptly addressed all identified vulnerabilities.

Through our collaborative efforts, the FooDriver Protocol project is now significantly more secure, ensuring the protection of user funds.

The FooDriver Protocol’s smart contracts security audit identified and addressed critical vulnerabilities, protecting user funds and ensuring platform stability. This case study demonstrates the importance of proactive security measures for blockchain-based projects, especially those dealing with financial assets. By conducting audits and addressing identified issues, the FooDriver Protocol Team has taken a significant step towards securing its platform and safeguarding user trust.