Home Funds overview Fund9 F9: Dapps, Products & IntegrationsFracada Addressing Audit

ID: Idea #422500

Share this on Twitter Share this on Facebook Share this on LinkedIn Share this on Reddit

Fracada Addressing Audit

Problem

Fracada is a fractionalized NFT project for Cardano. It was audited thanks to a Catalyst proposal in the previous round and now we need funds to implement the audit

Solution

The funds will be used for a Plutus developer to address the concerns found in the audit, followed by publishing the audit and updated code for the community

Total so far

This is the total amount allocated to Fracada Addressing Audit

Total Funds Requested

$15,000

Distributed

$6,000

Remaining

$9,000

Project milestones

2/4 milestones complete

Explore all milestones in-depth

About this idea

infrastructure nft smart-contract

More detail

[IMPACT] Please describe your proposed solution.

We have received a list of concerns by the auditor, which a Plutus developer as part of our team will address. We will then release the changes to address everything brought up by the audit as well as the audit itself.

[IMPACT] Please describe how your proposed solution will address the Challenge that you have submitted it in.

Fracada is a fractionalized NFT project that is an enitrely MIT open source Plutus contract that anybody can either deploy or use as a reference for their own contract. Addressing the audit will not only improve any projects that wanted to use Fracada directly, but also improve projects that wanted to use Fracada as a reference for their own work

[IMPACT] What are the main risks that could prevent you from delivering the project successfully and please explain how you will mitigate each risk?

Standard engineering risk (delay, overbudget). Additionally, even if we pass the audit, there is no guarantee that there won't still be a bug (audits are extremely important, but cannot guarantee the absence of bugs)

[FEASIBILITY] Please provide a detailed plan, including timeline and key milestones for delivering your proposal.

The audit report was received on June 30th and we plan to address the audit concerns in Q3

[FEASIBILITY] Please provide a detailed budget breakdown.

The full budget will be used for a Plutus developer to address the audit concerns

[FEASIBILITY] Please provide details of the people who will work on the project.

1 Plutus develop

[FEASIBILITY] If you are funded, will you return to Catalyst in a later round for further funding? Please explain why / why not.

No plans at the moment

[FEASIBILITY] Are you or any member of your team working on any other proposals in this Fund9?

Yes

[FEASIBILITY] Are you or your team working on any other proposals from previous Funds?

Yes

[AUDITABILITY] Please describe what you will measure to track your project's progress, and how will you measure these?

Addressing the auditor's concerns and releasing the code the resolves them

[AUDITABILITY] What does success for this project look like?

Successfully addressing all auditor concerns and releasing both the code and the audit result

[AUDITABILITY] Please provide information on whether this proposal is a continuation of a previously funded project in Catalyst or an entirely new one.

Continuation of https://cardano.ideascale.com/a/dtd/384625-48088

Monthly report

January 21, 2023 Progress report

Status: In progress

On track: Yes

Estimated completion date: -

Evidence

https://drive.google.com/open?id=1qYgVeoeGBrs_zVLjEyKpZX4IcEh-XCrC

Summary

We are pleased to announce that the audit has been completed and our Plutus Developer is actively implementing the recommended improvements. This proposal is closely related to the Fractionalized NFTs v2 (Fracada) proposal (700121). To clarify, we would like to provide further explanation on how this proposal aligns with the previous Fracada proposal. In response to the above scope, the Audit started in June 2022 with a two weeks period after which an initial set of findings were informally reported to the Fracada team. The intention behind the informal report was to maximise the utility of the hours spent auditing the scripts, by having the initial findings remediated before continuing with the audit. Once a set of audit findings remediations were provided, the audit resumed in December 2022. Given the scope of the changes done to address the initial findings, with significant changes to the project’s architecture, it was not feasible to properly audit the new design and implementation. Therefore, a mixed approach has been taken, formalising the initial findings and briefly checking the new implementation, with the main purpose of acknowledging that work has been done to address the findings. UPDATE: The Audit revealed the following five High Severity vulnerabilities: •Initial mint of more fraction tokens than declared in the FractionNFTDatum •Negative totalFractions value in FractionNFTDatum allows minting of more fraction tokens •No check to enforce the use of legit fraction token minting policy leads to fraction tokens being leaked •Same fraction token AssetClass can be used for different UTxOs locked in the validator •_ Signatures are not unique_ It also revealed the following two Medium Severity vulnerabilities: •Use of malicious minting policy for the fraction token •Double statisfaction attack can happen when fungible tokens are being locked in the validator As evidence, we are providing the title page of the report with completion date. The full report will be delivered soon. In addition, as Proof of Evidence, we also provide a link to the Pull request in which the team addressed the findings discovered in the Audit.

January 20, 2023 Progress report

Status: In progress

On track: Yes

Estimated completion date: -

Evidence

https://drive.google.com/open?id=1AQz_wYWPhIUAiWBICglNJ7ONWhsj6NoA

Summary

We are pleased to announce that the audit has been completed and our Plutus Developer is actively implementing the recommended improvements. This proposal is closely related to the Fractionalized NFTs v2 (Fracada) proposal (700121). To clarify, we would like to provide further explanation on how this proposal aligns with the previous Fracada proposal. From auditor: "In response to the above scope, the Audit started in June 2022 with a two weeks period after which an initial set of findings were informally reported to the Fracada team. The intention behind the informal report was to maximise the utility of the hours spent auditing the scripts, by having the initial findings remediated before continuing with the audit. Once a set of audit findings remediations were provided, the audit resumed in December 2022. Given the scope of the changes done to address the initial findings, with significant changes to the project’s architecture, it was not feasible to properly audit the new design and implementation. Therefore, a mixed approach has been taken, formalising the initial findings and briefly checking the new implementation, with the main purpose of acknowledging that work has been done to address the findings." As evidence, we are providing the title page of the report with completion date. Upon request from the Catalyst team, the full report can be shared, but we prefer to keep it confidential until all findings have been addressed (report also will be added to main repo after). In the next few weeks, our plan is to address all issues, deliver PoM2 and update the Fracada repo.

December 21, 2022 Progress report

Status: In progress

On track: Yes

Estimated completion date: -

Evidence

https://drive.google.com/open?id=1Yu2WL1x8FYCFW47XmmJCnxfiZ3aRk0D8

Summary

The audit phase for Fracada is currently underway, with the goal of completing the audit by the end of the year. The contractor is actively addressing all findings and conducting necessary tests. The next goal is to submit PoM2 for the proposal in early next year. It is important to ensure that all findings are properly addressed and all necessary tests are completed before the submission of PoM2 to ensure the success of the proposal.

December 20, 2022 Progress report

Status: In progress

On track: Yes

Estimated completion date: -

Summary

Evidence

https://github.com/dcSpark/fracada-il-primo/pulls

Explanation

Attached we share a repo in which the audit will be addressed in the separate branch.

November 24, 2022 Progress report

Status: In progress

On track: Yes

Estimated completion date: -

Summary

- Plutus version was updated. - Script architecture was updated to enable some fixes, mainly the introduction of the validity token. - Offchain code was maintained and kept in line with the changes and the new architecture. - Tests were maintained and kept in line with the changes and the new architecture. - New tests for audit findings are added to show that they were failing before our changes and are passing with them. As planned, we are implementing our grant proposal. On November 28 we will start the final part of our audit with external contractor. ETA on that is 2-3 weeks, so we will provide a more detailed update as part of the December reporting.

Evidence

https://github.com/dcSpark/fracada-il-primo/pull/5

Explanation

Vacuumlabs fracada audit findings remediation

Team

The dcSpark team has written multiple MIT open source Plutus contracts for the community to use freely such as an upgradeable treasury, a voting dApp and Fracada.

Sebastien Guillemot

dcSpark

Website

https://github.com/dcSpark/fracada

View project