MIMSwap
Security review case study
Overview
This document serves as an exposition of the Keel Formal security review process, detailing an engagement between the Keel Formal team and Abracadabra Money.
Keel Formal has conducted several reviews with the Abracadabra Money team, including their GMX V2 cauldrons and MultiRewards Staking contract. This case study focuses on the recent review of Abracadabra’s new MIMSwap product.
Keel Formal
Keel Formal is a Smart Contract security service provider re-imagining the traditional audit model with two competing internal Keel Formal teams, Smart Contract fuzzing, and a Pay-Per-Vulnerability pricing alternative. Keel Formal’s novel approach effectively incentivizes their security team to uncover as many vulnerabilities as possible and leave no stone unturned.
MIMSwap
MIMSwap is an automated-market-maker solution utilizing the PMM concept from DODO stable pools. The engagement focused on adaptations from the original DODO codebase as well as potential edge cases in the original implementation.
Why Keel Formal?
Keel Formal boasts a security team with extensive experience in banking, DeFi, economics, trading, and software correctness. As the Abracadabra team was bringing an adapted version of a novel AMM to market, it was paramount to engage a team with rigorous experience in AMM protocols and a strong background in fuzzing techniques.
Having conducted several reviews of novel concentrated liquidity AMM products and constructed dozens of professional fuzzing suites, Keel Formal was a clear choice.
The Report
Dissecting The Security Review
In the 1.5 week period from the 29th of February to the 11th of March, Abracadabra Money engaged Keel Formal to perform a security review of their PMM exchange.
During the engagement 6 security researchers spent a total of 9 person weeks to uncover multiple Critical & High severity findings in the project as well as to construct a comprehensive fuzzing suite to battle-test 25 key invariants.
The Research
To begin the review, each Keel Formal team focused first on gaining a deep understanding of the codebase, graphing the relevant PMM formula, creating diagrams, and carrying out internal discussions on the behavior of the system.
Following these discussions, Keel Formal identified several key bugs in the adaptation from DODO, such as H-02, M-02, and M-03. These findings were immediately shared with the MIMSwap team using a shared findings database for the engagement.
Both Keel Formal teams continued to scrutinize the code in scope, shifting focus towards the Blast deployment details and ultimately came to uncover several core issues with the Blast Native Yield claiming logic. These findings include C-01, H-04, and H-05.
The Fuzzing
While both Keel Formal teams conducted a manual review of the Smart Contracts in scope, a dedicated fuzzing engineer constructed a comprehensive fuzzing suite for the MagicLP, Router, and MagicLPFactory contracts.
The constructed fuzzing suite included 25 invariants assessed over 65 Million runs. Keel Formal’s comprehensive fuzzing suite successfully identified that tokens with 24 decimals and large totalSupply amounts are incompatible with the MagicLP system. Furthermore, Keel Formal’s fuzzing suite successfully detected a Critical bug which was introduced during remediations for the original findings.
Finally, after completing the engagement, the Keel Formal team opened a PR on the abracadabra-money-contracts repository to add the constructed fuzzing suite.
The PR, with over 3,000 lines of additions for the fuzzing suite, can be seen here:
https://github.com/Abracadabra-money/abracadabra-money-contracts/pull/142/files
Results
Throughout the 2 week engagement, Keel Formal uncovered 1 Critical, 5 High, 7 Medium, and 15 Low findings which were remediated by the Abracadabra team and promptly reviewed by Keel Formal.
Additionally, after engaging Keel Formal the Abracadabra team now has a comprehensive fuzzing suite to continually provide assurance to future updates made to the MagicLP system.
Keel Formal’s attention to detail and immense verification efforts were key in preparing the MIMSwap codebase for a successful launch, garnering 8 figures of TVL seamlessly.