DistrictOne audit
A private security review of DistrictOne (social money games), conducted with Three Sigma and completed on 13th June 2024 over 6 days. 0xSimao disclosed 10 findings: 4 medium, 1 low and 5 informational.
What DistrictOne is
DistrictOne merges money games with social interaction on Blast: LinkUp networking rewards, SpaceSprint competitions, DailyRally gem lotteries, SpaceShare investing in a space's success, all moving real balances that the contracts settle, with meme-token fair launches on the side.
Scope
The review treated each game as a small exchange: overfunding and refund paths in the fair launcher, signature validation on issuer addresses, share-specified participation, invite-fee accounting in storage, and the Blast yield that accrues to whichever contract holds the ETH.
Findings
Medium
- Claiming will fail for Ole and D1MemeToken if the overfunded ETH reverts
- FairLauncher::participate() should allow specifying a minimum number of shares due to the overfund mechanism
- FairLauncher inherits BlastNoYieldAdapter but will hold ETH
- Any signature is valid before the issuer address is set
Low
Informational
- Erc20Utils::safeTransferFrom() assumes the tokens are transferred to this, which may not be the case
- Deadline in Ole swap could be sent as a parameter to further prevent MEV
- Invite fees in FairLauncher::_calInviteFees() may be 0, in which case storage update could be skipped
- D1MemeTokens will be stuck whenever the merkle roots or the free claims are not fully claimed
- TokenVault allows withdrawals using offchain logic, so the offchain service must take into consideration reorgs
The report