hats-finance / illuminex-0x0bb4aa1f58719707405c231fcdf0b405714799cf

0 stars 0 forks source link

the `PeggedBTC.sol` doesnt protect its confidentiality #51

Open hats-bug-reporter[bot] opened 3 days ago

hats-bug-reporter[bot] commented 3 days ago

Github username: -- Twitter username: -- Submission hash (on-chain): 0x3c837b5bfcfeab203898ecc8648c431136d8c70013ee2c07d8bc1445074aff52 Severity: medium

Description: Description

the contract PeggedBTC.sol is private btc token and should absolutly be confedential as the projects target is that but the contract uses OpenZeppelin erc20 lib and Oasis Sapphire Docs strongly specified to fork and use it with eliminating the transparent emissions which will not destroys the confidentiality

Sapphire Security considerations DOCS

UNMODIFIED CONTRACTS MAY LEAK STATE THROUGH LOGS Base contracts like those provided by OpenZeppelin often emit logs containing private information. If you don't know they're doing that, you might undermine the confidentiality of your state. As a concrete example, the ERC-20 spec requires implementers to emit an event Transfer(from, to, amount), which is obviously problematic if you're writing a confidential token. What you can do instead is fork that contract and remove the offending emissions.

Recomendation

consider forking the erc20 openzeppelin and eliminate the emissions

rotcivegaf commented 2 days ago

Out of scope