Blast IDO Pools audit

A private security review of Blast Ido Pools (IDO launchpad), conducted with Three Sigma and completed on 7th August 2024 over 8 days. 0xSimao disclosed 13 findings: 4 high severity, 3 medium, 3 low and 3 informational.

What Blast Ido Pools is

The Blast IDO pools sell token launch allocations in rounds: each participant's purchasable amount scales with a multiplier rank, and the pools additionally sit on Blast, where contracts accrue native yield and gas refunds that someone must own.

Scope

The Three Sigma review covered round configuration and execution: proposing and executing multipliers, participation accounting, allocation finalisation across rounds, contribution limits, refunds when configurations are deleted, and the sweeping of spare tokens across several rounds.

High severity findings

• MultiplierContract::proposeMultipleUpdates() updates maxLevel before executing the update
• Funding cap in IDOPoolAbstract::_basicParticipationCheck() is imprecise and can lead to excessive tokens sold
• Cancelling rounds after finalizing will lead to incorrect globalTokenAllocPerIDORound tracking
• Rank and multiplier of a user can not be set if the user is registered for MetaIDO by the admin

Medium severity findings

• IDOPoolAbstract::withdrawSpareIDO() does not take into account that several rounds may use the same IdoToken
• fyToken contribution limits are incorrect as they compare fyToken and buyToken amounts with idoSize in idoToken units
• IDOPoolAbstract does not deal with yield and gas accrued on Blast

Low severity findings

• Incorrect RefundClaim event due to deleting idoConfig.accountPositions[msg.sender]
• Rounds in IDOPoolAbstract::manageRoundToMetaIDO() can be overriden
• Use of address.transfer instead of the recommended address.call{value: amount}("")

Informational findings

• Null transfers in IDOPoolAbstract::_depositToTreasury() could be skipped
• IDORoundConfig.idoPrice could have a comment somewhere specifying the units for better readability
• Missing disableInitializers() call in StandardIDOPool::constructor()

The report

Download report (PDF)