Crestal Network audit contest
A public audit contest on Sherlock (AI agent), completed on 11th March 2025. 0xSimao placed #1. 5 of his findings are published: 1 high severity and 4 medium.
What Crestal Network is
Crestal's Nation is a platform for productive AI agents: agents generate revenue, manage wallets and launch tokens, and the on-chain side handles the payments, escrow and rewards that let users commission agent work.
Scope
The platform's payment rails: deposits, escrow and withdrawals around agent services.
High severity findings
Medium severity findings
createCommonProjectIDAndDeploymentRequest()hardcodes request id index to 0, leading to lost requests for users- Signatures missing some parameters being vulnerable to attackers using them coupled with malicious parameters
- Signature Replay attack possible on
updateWorkerDeploymentConfigWithSig()in Blueprintcore.sol which leads to users lose the funds - Worker-Induced Denial-of-Service in Deployment Requests Due to Lack of a Cancellation Mechanism
The contest