Runtime Verification audits Zivoe’s Core and Locker Contracts

Runtime Verification is pleased to announce the Zivoe Core and Locker contracts audit completion. Zivoe is a decentralized credit protocol designed to be launched on an Ethereum Virtual Machine compatible blockchain. Its purpose is to disrupt predatory high-interest consumer lending across the globe by supporting more affordable credit solutions to underbanked and underserved communities using cryptocurrency and blockchain payment rails. 

Audit Scope

Zivoe is a DAO committed to creating a DeFi ecosystem of products that support more affordable credit solutions. On-chain users can provide liquidity to a tranche, which will then be lent out to borrowers. Initially, Zivoe plans to lend to socially conscious consumer lenders equipping them with the capital needed to offer more affordable credit solutions to consumers. Long term, Zivoe envisions lending directly to consumers and becoming the first autonomous blockchain based consumer lender. Users will receive yield on liquidity provided to a tranche. To effectively manage credit risk, Zivoe employs a tiered tranche system. Users can opt for the junior tranche, which offers higher risk but also has a higher target return, or the senior tranche, which is less risky but offers a lower target return. For entities such as consumer lenders interested in borrowing from Zivoe on-chain, a due diligence process will be conducted to evaluate them. All loans will be assigned to approved borrowers and funded by protocol assets previously allocated by the governance process in place.

The audit focused on reviewing two groups of contracts that account for the majority of the protocol and its functionalities: 

The “Core Contracts” are a group of contracts responsible for carrying out basic protocol governance operations. The contracts include protocol components that carry out a series of functionalities, including but not limited to:

• ITO (initial tranche offering) phase of the protocol, housekeeping actions needed to begin and finish the ITO period and to route the capital investments during the ITO phase.
• DAO governance components that are built on top of OZ’s Governor contracts.
• Token contracts issued by Zivoe.
• Contracts governing the rewards distribution and rewards vesting schedules.
• Yield distribution among tranches, governance and other parties involved.
• Contracts containing the global variables and shared functionality among the components of the protocol.
• Libraries that are responsible for mathematical operations during yield partitioning, time-locked operations and ownable contracts. 

The “Locker Contracts” are a group of contracts responsible for the governance of funds. The contracts include components that govern the funds that are maintained in various different ways. The following locker contracts were included in the scope:

• Lockers that govern loan management and lifecycle. These lockers keep track of the status of a provided loan, depending on the type of the loan, and govern the payments done by the loan taker in time.
• Lockers that govern the ZVE (a token supplied by the protocol) emissions. The locker gradually decreases the amount of emissions of ZVE over time. The decrease rate is parametrically set by the DAO governance.
• Lockers that handle the redemptions of “tranche tokens” (a token issued by the protocol for capital providers) to stablecoins. This locker gathers redemptions that are issued over a time period and handles the redemptions altogether following a period of time.
• Lockers that earn yield by providing liquidity and handling the conversion of funds over to third-party protocols.  

The audit scope was limited to the Solidity smart contract source code. Off-chain, auto-generated or client-side portions of the codebase, as well as deployment and upgrade scripts, are not in the scope of this engagement. A detailed list of all the contracts, libraries and interfaces audited can be found in the reports. 

Methodology

Runtime Verification conducted a combination of design and manual code review for a period of 10 weeks and delivered two detailed reports. The Core Contracts report was delivered on July 10th, 2023 and the second report about the Locker Contracts was delivered on August 18th, 2023.

After an initial talk between Zivoe and the auditors, it was decided to split the audit into two parts due to the length of the scope and lines of code to be audited. The most natural way to split it was to first conduct an audit on the Core Contracts, followed by one, one-week break before starting the second part of the audit focused on the Locker Contracts. The one-week break was essential not only to prepare for the second part of the audit but also to deliver a report and discuss key elements of some of the findings and potential solutions to them. 

Both phases of the audit started with a design review of the code and logic of the protocol before diving into the code itself. Design audits are a key element of the security lifecycle, especially for projects, such as Zivoe, that are in the development phase and no code has been deployed. While code audits are perfect for finding mistakes in the code that could lead to an exploit of a protocol, design audits dive deeper into the business logic and design of the project itself and aim to find ways to improve the performance, calculate potential optimizations and to identify possible design flaws in the business logic and general operation of the protocol that could lead into a code exploit in the future. Zivoe and auditors worked closely together to identify the main properties that the protocol should hold to ensure once the code was deployed, it would perform as intended. The design audit was followed by a code review that focused on the detection of code flaws, such as bugs and inconsistencies, that could also lead to potential attacks, as well as verifying if the properties identified during the design audit were being respected or violated. 

On top of the usual audit flow followed for code auditing, special attention was given to each of the phases depending on the contracts’ features and how likely they could become a focus for a potential attack. 

The Core Contracts focus was directed into two different areas. The first area is the OZ adoptions for the time lock controls and DAO governance of the protocol. Zivoe has its own flow of transferring the governance of the protocol to the DAO after the protocol deployment and the ITO process. We have reviewed this flow by considering the best practices that are applied in the related area and advised the team accordingly. Secondly, a relatively complicated mathematical calculation was used during the partitioning of the yield that will be distributed to the tranches. Basically, the calculation used an exponential moving average to determine a stabilized amount of earnings through time and decide a meaningful proportion of yield to distribute to the parties regarding the amount of defaulted loans and the risk profiles for the tranches. We have performed precision analysis and kept track of the possible exceptional input in the mathematical library that they were using to determine any mathematical calamities (e.g. division by zero, overflow and underflow, etc.) that might be present. 

For the lockers, our focus was on the integrations implemented by the protocol. There were a number of different integrations that were performed with different protocols. Specifically, the 1Inch integration was using low-level byte operations to validate some of the provided input that requires careful overview if the provided byte array slicing operations are correct. Additionally, we advised the use of best practices for the integrations that they provide, such as using an expected output bound. We have checked and informed the team of the latest security breaches that were performed over the integrated protocol. For example, we checked if the vulnerability found in the Curve exploit affects their contracts and provided information on how to mitigate such exploits. Lockers also contain some intricate mathematical operations in which we have identified many flaws, including precision errors. While doing so we have used precision analysis and mathematical proving techniques such as direct proofs and mathematical induction.

A list of the findings and their details can be found in both reports in our Github repository. 

Results

The audit identified and highlighted some issues along with some informative findings. Although a formal review of code fixes was outside the scope of the audit, a best-effort review was conducted on some of the code changes.

Readers interested in a more detailed and technical explanation of the findings can go over the full report in our GitHub repository. 

About Zivoe

Zivoe is a credit protocol working to disrupt the high-interest consumer lending market while bridging the gap between traditional finance (TradFi) and decentralized finance (DeFi). Committed to financial inclusivity, Zivoe's primary objective is to democratize credit access for underbanked and underserved communities while simultaneously generating sustainable returns for liquidity providers.

About Runtime Verification

Runtime Verification is a technology startup based in Champaign-Urbana, Illinois. The company uses formal methods to perform security audits on virtual machines and smart contracts on public blockchains. It also provides software testing, verification services and products to improve the safety, reliability, and correctness of software systems in the blockchain field.