Minswap Aiken V2 Audit

[GENERAL] Name and surname of main applicant

[GENERAL] Email address of main applicant

Additional applicants

No

[GENERAL] Please specify how many months you expect your project to last (from 2-12 months)

[GENERAL] Please indicate if your proposal has been auto-translated into English from another language.

[GENERAL] Does your project have any dependencies on other organizations, technical or otherwise?

[GENERAL] If YES, please describe what the dependency is and why you believe it is essential for your project’s delivery. If NO, please write “No dependencies.” .

No dependencies.

[GENERAL] Will your project’s output/s be fully open source?

[GENERAL] If NO, please describe which outputs are not going to be open source. If YES, please write “Project will be fully open source.”

Project will be fully open source.

[METADATA] Category of Proposal

[IMPACT] Please describe your proposed solution.

Minswap Labs is the development company that built the Minswap DEX, currently the DeFi platform with the highest Total Value Locked (TVL) on Cardano with $53,33mn locked (data as of July 4th 2023 from DeFi Llama here: https://defillama.com/chain/Cardano).

Minswap Labs is developing a V2 version of the DEX Smart Contract with higher throughput and new features. It will be open sourced and built on Aiken, a programming language and framework based on Rust that allows rapid development of Plutus v2 smart contracts with optimal performance and gas cost.

Cardano is an emerging ecosystem, programming languages such as Aiken are new and audits for Smart Contract built leveraging them are costly. Minswap Labs is requesting funding to conduct two security audits on the DEX V2 Smart Contract. Cardano's eUTXO ledger design is unique among blockchains, meaning dApps and auditing firms are employing relatively new designs and techniques. In our experience, this has demonstrated that two security audits are needed to ensure the security of a Smart Contract destined to hold hundreds of millions or even billions worth of $ADA. 

[IMPACT] How does your proposed solution address the challenge and what benefits will this bring to the Cardano ecosystem?

The main aim of this challenge of Products & Integration is to fund projects that increase user adoption on Cardano. The Minswap DEX is currently the Cardano dApp with most Daily Active Users and transactions (data available at: https://dappsoncardano.com/). However, in its current version, the DEX Smart Contract still has some inefficiencies that prevent further user adoption. Building a version 2 of the DEX, conducting two high security audits and open sourcing the Smart Contract will bring the following benefits to the Cardano ecosystem: 

1. Higher throughput DEX: the Minswap DEX V2 will be the one of first major DeFi products to utilize Aiken and leverage its improvements. The aim is to bring more DEX features, leveraging Plutus V2 (Aiken) for reducing chain storage and increasing DEX throughput. 
2. Enhanced user experience: The V2 DEX will include improvements to speed, but also to transaction cost and functionality that will make the user experience for Cardano DeFi users much better.
3. Increased DeFi usage: with a secure, open-sourced DEX with higher throughput and novel features, Cardano will become a more attractive ecosystem for users looking to trade and obtain yield on their assets. 
4. Open Sourcing an Aiken-Smart Contract: open sourcing a major DeFi Smart Contract based on Aiken and audited twice will majorly benefit the Cardano developer community. It will provide an example of what a productionized DeFi contract looks like built on Aiken.
5. Increased security: having previously open-sourced the DEX Smart Contract, Minswap Labs has experience in employing best practices, and treating the security of our users' funds very seriously. The emphasis on two audits instead of one also highlights the commitment of Minswap Labs towards the complete security of funds.
6. New features and leveraging Cardano improvements: the DEX V2 will not only have several new and exciting features, but it will also leverage improvements that have been made since the launch of the DEX V1 such as benefitting from Reference Scripts and Inline Datums. 

[IMPACT] How do you intend to measure the success of your project?

Two types of measures will be used to measure the success: 

Quantitative Measures:

• Total Value Locked: how much liquidity is the DEX V2 capturing across Cardano?
• Trading Volume: how much volume is the Minswap DEX V2 capturing across Cardano?
• Monthly Unique Active Wallets: how many monthly unique wallets are using the Minswap DEX V2?
• Throughput improvements: how does an Aiken based (Plutus V2) Smart Contract improve throughput of DeFi dApps on Cardano?

Qualitative Measures:

• Composability across Cardano DeFi: how are other protocols using the Minswap DEX V2 to offer new features for their users and enhance composability across the ecosystem? 
• Open Source usage: how are developers finding the Aiken Minswap Stableswap useful? 
• User Feedback: constant feedback from the community around the throughput, features and user experience will be gathered and used for improvements.

[IMPACT] Please describe your plans to share the outputs and results of your project?

There will be 3 stages in the project and each will require a different strategy:

Prior to launch of the DEX V2: once both audits are fully completed and the fixes are addressed, the two Audit Reports will be released. The Smart Contract will be open-sourced and a Bug Bounty period will commence. Once the Bug Bounty period is finalized, the Minswap DEX V2 will be launched.

Prior to launch, an article will be released with the new features of the Minswap DEX V2, as well as the throughput improvements enabled by Aiken. A testnet environment will be set up for users to interact and get familiar with the Minswap DEX V2 before mainnet.

During the launch of the DEX V2: platform launch will be shared on all public channels. 

After the launch of the DEX V2: data related to the quantitative and qualitative measures mentioned above will be gathered and shared through all public channels.

[CAPABILITY/ FEASIBILITY] What is your capability to deliver your project with high levels of trust and accountability?

The Minswap Labs team is composed of several highly experienced Plutus engineers that have been working on developing Plutus-based Smart Contracts for more than 2 years. As such, Minswap Labs has established itself as a highly experienced and capable company specialized in developing DeFi tools in the Cardano Ecosystem.

To see an example of a product, kindly head over to https://app.minswap.org/ and try it out!

The Minswap DEX is currently the Cardano dApp with most Daily Active Users and transactions. Data available at: https://dappsoncardano.com/

It is also currently the Cardano DeFi dApp with highest Total Value Locked and handling the majority of Trading Volume on Cardano DEXs. Data available here: https://defillama.com/chain/Cardano?currency=USD

Minswap Labs has experience having previously undergone an audit for the current DEX Smart Contracts. The two different audit firms contracted for the audit will be highly reputable firms with experience.

[CAPABILITY/ FEASIBILITY] What are the main goals for the project and how will you validate if your approach is feasible?

As mentioned above, this project has several goals, they can be categorized into 2 types:

Product Goals

Everything related to the new features which will come with the DEX V2. The main goal on the Product side is to increase DeFi usage on Cardano by offering a more performant and easy to use swapping platform.

Development Goals

Everything related to the development and the auditing of the DEX V2 in the Aiken programming language leveraging Plutus V2 improvements. The main aim on the Development side is to increase throughput and open source a secure, double-audited Smart Contract. 

[CAPABILITY/ FEASIBILITY] Please provide a detailed breakdown of your project’s milestones and each of the main tasks or activities to reach the milestone plus the expected timeline for the delivery.

As of today July 12th 2023, the Minswap DEX V2 code is not yet complete. Minswap Labs is requesting funding for the audit process, as such the timeline will commence with the start of the audit.

Phase 1: Audits and and addressing bugs

Timeline: Months 1-2

Tasks:

• Engage two reputable third-party security audit firms to conduct two separate security audits of the Minswap DEX V2 Smart Contract.
• Collaborate closely with the third party auditing companies to address vulnerabilities identified during the audit process.
• Document the results and steps taken to address the vulnerabilities discovered. 
• Conduct testing to identify and measure throughput improvements.

Phase 2: Launch Testnet, Open source and Bug Bounty

Timeline: Month 3

• Release an article with the new features of the Minswap DEX V2, the throughput improvements enabled by Aiken, and the Audit Discoveries. 
• Release both Audit Reports.
• A testnet environment will be set up for users to interact and get familiar with the Minswap DEX V2 before mainnet.
• The Smart Contract will be open-sourced and a Bug Bounty period will commence. 

Phase 3: Final Steps and Launch

Timeline: Month 4

• Address all possible issues discovered both during the Testnet and the Bug Bounty.
• Communicate the successful completion of both security audits, the fixes addressed after the testnet and Bug Bounty and the upcoming launch on the mainnet.
• The DEX V2 Smart Contract will be integrated in the Minswap DEX UI.

After - The process of collecting user feedback and evaluating success based on the metrics highlighted above will commence.

[CAPABILITY/ FEASIBILITY] Please describe the deliverables, outputs and intended outcomes of each milestone.

Phase 1: 

Deliverables, Outputs and Intended Outcomes:

• Provide Smart Contracts and codebase documentation to both security audit firms.
• Document the results from the audits and steps taken to address the vulnerabilities discovered. 
• Testing the DEX V2 Smart Contracts to measure improvements.
• Tested, audited, new Smart Contracts which will reduce the risk of potential exploits and increased confidence of ecosystem participants.

Phase 2: 

Deliverables, Outputs and Intended Outcomes:

• Article with the new features of the Minswap DEX V2, the throughput improvements enabled by Aiken, and the Audit Discoveries.
• Two Audit Reports.
• Testnet Environment for anyone to test the DEX V2 Smart Contracts.
• Open-sourced Smart Contract.
• Commencement of Bug Bounty and document detailing the aim of scope of the program.
• Detailed documentation of the DEX V2 Smart Contracts for both users and developers.

Phase 3: 

Deliverables, Outputs and Intended Outcomes:

• Communicate on steps taken in the light of the Bug Bounty and Testnet. 
• Conclusion of a process to ensure the maximum security of contracts ready to store significant funds.
• Finalized functional Smart Contracts ready to be deployed.
• Collect feedback and monitor key performance indicators to evaluate the success of the process. 

[RESOURCES & VALUE FOR MONEY] Please provide a detailed budget breakdown of the proposed work and resources.

Audit

The audits will be performed by reputable third party audit firms. Given the code is not yet complete, it is not possible to receive a quote on the audit yet. However, Minswap Labs has been in the negotiation process with several audits firms for the audit of Stableswap (where the code is fully complete). 

The quotes used to budget for the audit of the Minswap DEX V2 are obtained based on the quotes by those firms obtained for the audit of the Stableswap. This is accounting for the fact that the DEX V2 Smart Contract will be more complex and have more code lines, as it has more advanced features. 

First Audit Budget: $30,000

Second Audit Budget: $65,000

Minswap Labs will leverage its reputation and experience in the Cardano ecosystem to attempt lower these audit quotes. If there is any excess of funds as a result of that negotiation, they will be allocated towards the Bug Bounty.

Development

There will be 2 engineers for around 160 hours (1 month) working on addressing the fixes discovered in the audit, conducting tests and preparing detailed documentation 

1 Full-time Backend engineer working for 1 month

1 Full-time Senior Blockchain engineer working for 1 month

Hourly rate: $80

Development Budget: $25,600

Bug Bounty

Bug Bounty rewards will be distributed according to the severity of the found vulnerabilities (if any). 

A more detailed document regarding the scope of the vulnerabilities of the Bug Bounty Program and how to submit a bug will be shared once the audits have been conducted. It will follow the same structure as Bug Bounties on Immunefi.

Bug Bounty Budget: $15,000

Total Budget in USD: $135,600

Total Budget in ADA: 467,000 $ADA (converted on July 12th 2023)

[RESOURCES & VALUE FOR MONEY] How does the cost of the project represent value for money for the Cardano ecosystem?

The cost of the project represent value for money for the Cardano ecosystem for the following deliverables:

• An efficient, innovative DEX smart contract with higher throughput and new features.
• A focus on security, by conducting not one but tow security audits on the smart contract.
• An open-sourced Aiken Smart Contract which will provide an example developers with an example of what a productionized DeFi contract looks like built on Aiken

[IMPORTANT NOTE] The Applicant agreed to Fund10 rules and also that data in the Submission Form and other data provided by the project team during the course of the project will be publicly available.