# Blast IDO Pools audit Three Sigma · IDO launchpad · 7th August 2024 A private security review of Blast Ido Pools (IDO launchpad), conducted with Three Sigma and completed on 7th August 2024 over 8 days. 0xSimao disclosed 13 findings: 4 high severity, 3 medium, 3 low and 3 informational. ## What Blast Ido Pools is The Blast IDO pools sell token launch allocations in rounds: each participant's purchasable amount scales with a multiplier rank, and the pools additionally sit on Blast, where contracts accrue native yield and gas refunds that someone must own. ## Scope The Three Sigma review covered round configuration and execution: proposing and executing multipliers, participation accounting, allocation finalisation across rounds, contribution limits, refunds when configurations are deleted, and the sweeping of spare tokens across several rounds. ## High severity findings - [`MultiplierContract::proposeMultipleUpdates()` updates `maxLevel` before executing the update](https://0xsimao.com/findings/blast-ido-pools-multiplier-propose-multiple-executing) - [Funding cap in `IDOPoolAbstract::_basicParticipationCheck()` is imprecise and can lead to excessive tokens sold](https://0xsimao.com/findings/blast-ido-pools-participation-imprecise-excessive-sold) - [Cancelling rounds after finalizing will lead to incorrect `globalTokenAllocPerIDORound` tracking](https://0xsimao.com/findings/blast-ido-pools-finalizing-alloc-round-tracking) - [Rank and multiplier of a user can not be set if the user is registered for `MetaIDO` by the admin](https://0xsimao.com/findings/blast-ido-pools-rank-multiplier-registered-meta) ## Medium severity findings - [`IDOPoolAbstract::withdrawSpareIDO()` does not take into account that several rounds may use the same `IdoToken`](https://0xsimao.com/findings/blast-ido-pools-withdraw-spare-several-rounds) - [`fyToken` contribution limits are incorrect as they compare `fyToken` and `buyToken` amounts with `idoSize` in `idoToken` units](https://0xsimao.com/findings/blast-ido-pools-contribution-limits-compare-buy) - [`IDOPoolAbstract` does not deal with yield and gas accrued on Blast](https://0xsimao.com/findings/blast-ido-pools-yield-gas-accrued-blast) ## Low severity findings - [Incorrect `RefundClaim` event due to deleting `idoConfig.accountPositions[msg.sender]`](https://0xsimao.com/findings/blast-ido-pools-refund-deleting-config-positions) - [Rounds in `IDOPoolAbstract::manageRoundToMetaIDO()` can be overriden](https://0xsimao.com/findings/blast-ido-pools-manage-round-meta-overriden) - [Use of `address.transfer` instead of the recommended `address.call{value: amount}("")`](https://0xsimao.com/findings/blast-ido-pools-transfer-recommended-call-value) ## Informational findings - [Null transfers in `IDOPoolAbstract::_depositToTreasury()` could be skipped](https://0xsimao.com/findings/blast-ido-pools-null-transfers-deposit-skipped) - [`IDORoundConfig.idoPrice` could have a comment somewhere specifying the units for better readability](https://0xsimao.com/findings/blast-ido-pools-round-price-somewhere-specifying) - [Missing `disableInitializers()` call in `StandardIDOPool::constructor()`](https://0xsimao.com/findings/blast-ido-pools-disable-initializers-standard-constructor) ## The report [Download the report (PDF)](https://0xsimao.com/reports/2024-08-07-blast-ido-pools.pdf)