The developers of the Castello (CAST) Token Contract contracted byterocket to conduct a smart contract audit of their token contract. The contract is an ERC20-based contract deployed on Ethereum Mainnet.
Castello aims to “revolutionize the cryptocurrency market and combine the worlds of artistry and blockchain technology via a blockchain, digitizing the funding process for a world-class artwork as well as its future use cases”.
The team of byterocket reviewed and audited the above smart contracts in the course of this audit. We started on the 8th and finished on the 12th of April 2022.
The audit included the following services:
byterocket gained access to the code via Etherscan, where the development team published the contract code.
We conducted a manual multi-pass code review of the smart contracts mentioned in section (1). Three different people went through the smart contract independently and compared their results in multiple concluding discussions.
The manual review and analysis were additionally supported by multiple automated reviewing tools, like Slither, GasGauge, Manticore, and different fuzzing tools.
We are categorizing our findings into four different levels of severity:
On the code level, we found no bugs or flaws. Our automated systems and review tools also did not find any additional ones.
On the code level, we found no bugs or flaws. Our automated systems and review tools also did not find any additional ones.
Part of our audits are also analyses of the protocol and its logic. A team of three auditors went through the implementation and documentation of the implemented protocol.
We went through all of the provided documentation, tests, and contracts in a very detailed manner. The general description of the protocol is very well made, it’s very easy to understand how each function is supposed to work and what it implements.
We were not able to discover any problems in the protocol implemented in the smart contract.
This contract correctly implements an ERC20 token, based on the standard by OpenZeppelin (v4.4.1). There have been no modifications to any of the imported functionalities as well as the ERC20 standard itself. As the contract is not upgradeable and has no owner, no changes to the contract can be made at any time. The token was deployed with the following details:
Name: Castello Coin
Symbol: CAST
Decimals: 8
Total Supply: 440,000,000
The token has been deployed on the 1st of February 2022 on Ethereum Mainnet at the address 0x3FAb0bBAa03BCEAF7C49E2b12877dB0142BE65FC.
In order to use the token on Polygon, the development team made use of the official Proof of Stake Token Bridge by Polygon Technology. When bridging a token for the first time, the bridge system deploys a mirror contract on the Polygon Chain, which can not be modified by the original token deployer/owner. In the case of the Castello Token, the bridge system has deployed the Polygon version of the contract to the address 0xa554E5a79CAEbFEAE867C66A56a951338f748C8A.
During our code review (which was done manually and automated), we found no bugs or flaws. Our automated systems and review tools also did not find any additional ones.
The protocol review and analysis did neither uncover any game-theoretical nature problems nor any other functions prone to abuse.
During our multiple deployments to various local testnets, we haven’t been able to find any problems or unforeseen issues.
In general, we are delighted with the overall quality of the code and its documentation.
As of the date of publication, the information provided in this report reflects the presently held understanding of the auditor’s knowledge of security patterns as they relate to the client’s contract(s), assuming that blockchain technologies, in particular, will continue to undergo frequent and ongoing development and therefore introduce unknown technical risks and flaws. The scope of the audit presented here is limited to the issues identified in the preliminary section and discussed in more detail in subsequent sections. The audit report does not address or provide opinions on any security aspects of the Solidity compiler, the tools used in the development of the contracts or the blockchain technologies themselves, or any issues not specifically addressed in this audit report.
The audit report makes no statements or warranties about the utility of the code, safety of the code, suitability of the business model, investment advice, endorsement of the platform or its products, the legal framework for the business model, or any other statements about the suitability of the contracts for a particular purpose, or their bug-free status.
To the full extent permissible by applicable law, the auditors disclaim all warranties, express or implied. The information in this report is provided “as is” without warranty, representation, or guarantee of any kind, including the accuracy of the information provided. The auditors hereby disclaim, and each client or user of this audit report hereby waives, releases and holds all auditors harmless from, any and all liability, damage, expense, or harm (actual, threatened, or claimed) from such use.
We store our public audit reports on IPFS; a peer-to-peer network called the "Inter Planetary File System". This allows us to store our reports in a distributed network instead of just a single server, so even if our website is down, every report is still available.
The IPFS Hash, a unique identifier of the report, is signed on-chain by both the client and us to prove that both sides have approved this audit report. This signing mechanism allows users to verify that neither side has faked or tampered with the audit.
