Sophon, an entertainment-focused hyperchain on ZkSync, is hosting an airdrop process. In this process, anyone can stake certain assets to qualify for a $SOPH airdrop scheduled for Q3, 2024.
Scope
Contest Results
On what chains are the smart contracts going to be deployed?
Ethereum
If you are integrating tokens, are you allowing only whitelisted tokens to work with the codebase or any complying with the standard? Are they assumed to have certain properties, e.g. be non-reentrant? Are there any types of <a href="https://github.com/d-xo/weird-erc20" target="_blank" rel="noopener noreferrer">weird tokens</a> you want to integrate?
Only whitelisted ERC20 standard tokens can work with the codebase.
Are the admins of the protocols your contracts integrate with (if any) TRUSTED or RESTRICTED? If these integrations are trusted, should auditors also assume they are always responsive, for example, are oracles trusted to provide non-stale information, or VRF providers to respond within a designated timeframe?
All the external admins are trusted.
Are there any protocol roles? Please list them and provide whether they are TRUSTED or RESTRICTED, or provide a more comprehensive description of what a role can and can't do/impact.
There is a single admin (owner) that is trusted.
For permissioned functions, please list all checks and requirements that will be made before calling the function.
Permissioned functions are secure by OZ Ownable (onlyOwner modifier).
Is the codebase expected to comply with any EIPs? Can there be/are there any deviations from the specification?
n/a
Are there any off-chain mechanisms or off-chain procedures for the protocol (keeper bots, arbitrage bots, etc.)?
no
Are there any hardcoded values that you intend to change before (some) deployments?
Yes. The specifics around per block points emission rate for the farm as a whole and for each pool will be defined later. The specific pools in the farm will be finalized later as well.
If the codebase is to be deployed on an L2, what should be the behavior of the protocol in case of sequencer issues (if applicable)? Should Sherlock assume that the Sequencer won't misbehave, including going offline?
We only plan to deploy the codebase on Ethereum mainnet at this time.
Should potential issues, like broken assumptions about function behavior, be reported if they could pose risks in future integrations, even if they might not be an issue in the context of the scope? If yes, can you elaborate on properties/invariants that should hold?
n/a
Please discuss any design choices you made.
n/a
Please list any known issues/acceptable risks that should not result in a valid finding.
n/a
We will report issues where the core protocol functionality is inaccessible for at least 7 days. Would you like to override this value?
no need to override
Please provide links to previous audits (if any).
n/a
Please list any relevant protocol resources.
Additional audit information.
Any bridging related code is considered out of scope
Total Rewards
Contest Pool
Lead Senior Watson
Judging Pool
Lead Judge
13,000 USDC
5,500 USDC
900 USDC
1,100 USDC
Status
Scope
Start Time
End Time
Judging Rules