ViWo Info
ViWo — a revolutionary digital platform proudly created and owned by SmarTech LLC, a USA-verified technology innovator with over 17 years of excellence. ViWo fuses social media, decentralized marketplaces, and blockchain technology into one seamless ecosystem. Powered by V-Coin, ViWo lets users monetize content, trade digital and physical products, and grow their wealth — all with zero transaction fees. With eco-friendly initiatives and immersive Augmented Reality (AR) integration, ViWo is built for the future.
Team and KYC Verification
The team has securely submitted their personal information to SolidProof.io for verification.
In the event of any fraudulent activities, this information will be promptly reported to the relevant authorities to ensure accountability and compliance.
TrustNet Score
The TrustNet Score evaluates crypto projects based on audit results, security, KYC verification, and social media presence. This score offers a quick, transparent view of a project's credibility, helping users make informed decisions in the Web3 space.
Real-Time Threat Detection
Real-time threat detection, powered by Cyvers.io,
is currently not
activated
for this project.
This advanced feature provides continuous monitoring and instant alerts to safeguard your assets from potential security threats. Real-time detection enhances your project's security by proactively identifying and mitigating risks.
For more information, click here.
Security Assessments
Summary and Final Words
No crucial issues found
The contract does not contain issues of high or medium criticality. This means that no known vulnerabilities were found in the source code.
Ownership is not renounced
Contract can be manipulated by owner functions.
Contract is upgradeable
The contract uses a proxy pattern or similar mechanism, enabling future upgrades. This can introduce risks if the upgrade mechanism is not securely managed.
Scope of Work
This audit encompasses the evaluation of the VCoin token implementation project, including token creation, distribution, presale, and vesting management modules. The codebase consists primarily of TypeScript modules interfacing with Solana's Token-2022 program.
The auditing process consists of the following systematic steps:
- Documentation Review: Analysis of provided technical documentation and security audit guide to fully understand the project's architecture, component interactions, and security requirements.
- Manual Code Examination: Thorough module-by-module review of the VCoin implementation, focusing on security-critical components like keypair management, token transfers, and authorization checks.
- Implementation Validation: Verification that the code accurately implements the intended token features, security controls, and error handling as specified in the documentation.
- Test Coverage Assessment: Evaluation of the extensive test suite (94% statement coverage, 81% branch coverage) to identify any potential gaps in security testing.
- Static Analysis: Utilization of static analysis tools including Qodana to identify code quality issues and potential vulnerabilities through automated means.
- Security Control Evaluation: Assessment of cryptographic implementations, validation mechanisms, error handling, and authority verification against established security best practices.
- Actionable Recommendations: Provision of specific and prioritized recommendations to address identified vulnerabilities, with an emphasis on private key management, authority verification, and data integrity enhancements.
Our security audit covers the TypeScript implementation as provided. The audit specifically focuses on the backend code and does not include review of any smart contracts or on-chain programs beyond their interaction points with this codebase.
Final Words
The following provides a concise summary of the audit report, accompanied by insightful comments from the auditor. This overview captures the key findings and observations, offering valuable context and clarity.
The VCoin implementation demonstrates strong security improvements since the initial audit, with significant enhancements to key management, input validation, cryptographic operations, and price oracle implementation. The codebase maintains a well-structured, modular architecture and now shows advanced security awareness through its implementation of encryption, digital signatures, and comprehensive rate limiting.
Our assessment found that most critical and high-severity issues have been successfully addressed, with only minor concerns remaining. The most significant improvements involve authority verification, transaction synchronization, and enhanced security mechanisms.
Technical Assessment
The code architecture continues to follow good separation of concerns with utilities centralized in common modules. Security improvements are evident in the implementation of AES-256-GCM encryption for keypair storage, proper digital signatures for metadata integrity, and robust fallback mechanisms for price oracles.
Key improvements include:
- Encrypted storage for sensitive keypair information
- Masked command line input for private keys
- Multi-source price oracle implementation with fallbacks
- Comprehensive rate limiting for financial operations
- Proper path traversal protection and input validation
- Thread-safe file operations with proper locking mechanisms
Audit Checklist Completion
Our re-audit has verified significant progress on all items from the VCoin Security Audit Guide:
- Keypair Management: ✅ Fixed critical issues with storage and handling through encryption
- Transaction Security: ✅ Fixed with improved balance verification and transaction synchronization
- Input Validation: ✅ Fixed gaps in path validation and public key input handling
- Authorization: ✅ Fixed with standardized verification functions consistently used
- Error Handling: ⚠️ Partially fixed with custom error types but inconsistent application
- File System Operations: ✅ Fixed issues with permission settings, path validation and synchronization
Recommendations
We recommend addressing these remaining improvements before production deployment:
- Standardize error handling with consistent use of custom error types
- Improve API error logging to capture complete error details
- Make timeout values for network requests configurable
With these improvements, the VCoin implementation will provide a robust security posture appropriate for a financial application handling user assets.
Note - This Audit report consists of a security analysis of the VCoin backend. This analysis did not include functional testing (or unit testing) of the contract's logic. Moreover, we only audited the codebase for the VCoin team. Other systems associated with the project were not audited by our team. We recommend investors do their own research before investing.
Files and details
Functions
public
/
State variables
public
/
Total lines
of code
/
Capabilities
Hover on items
/
Functions
public
/
State variables
public
/
Total lines
of code
/
Capabilities
Hover on items
/
Functions
public
/
State variables
public
/
Total lines
of code
/
Capabilities
Hover on items
/
Functions
public
/
State variables
public
/
Total lines
of code
/
Capabilities
Hover on items
/
Functions
public
/
State variables
public
/
Total lines
of code
/
Capabilities
Hover on items
/
Functions
public
/
State variables
public
/
Total lines
of code
/
Capabilities
Hover on items
/
Functions
public
/
State variables
public
/
Total lines
of code
/
Capabilities
Hover on items
/
Functions
public
/
State variables
public
/
Total lines
of code
/
Capabilities
Hover on items
/
Functions
public
/
State variables
public
/
Total lines
of code
/
Capabilities
Hover on items
/
Functions
public
/
State variables
public
/
Total lines
of code
/
Capabilities
Hover on items
/
Functions
public
/
State variables
public
/
Total lines
of code
/
Capabilities
Hover on items
/
Functions
public
/
State variables
public
/
Total lines
of code
/
Capabilities
Hover on items
/
Findings and Audit result
critical Issues | 1 findings
Resolved
#1 critical Issue
Unprotected Private Key Input
The function getKeypairFromPhantom() accepts private keys directly from command line input, exposing keys to command history, process listing, and potential shoulder surfing.
high Issues | 4 findings
Resolved
#1 high Issue
Unencrypted Storage of Keypairs
Private keys are stored as unencrypted JSON files, making them vulnerable if the filesystem is compromised.
Resolved
#2 high Issue
Inconsistent Authority Verification
The codebase uses different methods to verify authorities - publicKey.equals() in some places and string comparison in others, which can lead to inconsistent security enforcement.
Resolved
#3 high Issue
Weak Metadata Integrity Protection
The metadata integrity is only protected by a SHA-256 checksum without binding to the authority, allowing potential tampering if the checksum is known. Relying solely on a checksum (without digital signatures) can be less robust, especially if an attacker can recalculate and update the checksum.
Resolved
#4 high Issue
Mock Oracle Usage Without Warning
Price conversion uses a mock function getUsdToSolRate() that returns a hardcoded value (50) without any indication that it's not a real oracle.
medium Issues | 6 findings
Resolved
#1 medium Issue
Race Conditions in Token Transfer and Vesting Operations
The codebase lacks proper synchronization mechanisms when performing token transfers and vesting operations. Multiple concurrent operations could lead to data corruption, lost updates, double-spending, or duplicate vesting releases due to the load-process-save pattern used without any locking mechanisms.
Resolved
#2 medium Issue
Lack of Rate Limiting on Presale Purchase Endpoint
The presale purchase functionality currently does not enforce rate limiting, which could allow an attacker to flood the system with requests. Rapid, repeated calls to processPurchase in presale.ts might lead to a denial of service or allow brute force purchase attempts.
Resolved
#3 medium Issue
Path Traversal Protection Weaknesses
Path validation in validateKeypairName() uses string includes() checks which may be bypassed with certain inputs.
Resolved
#4 medium Issue
Missing Vesting Token Balance Verification
The executeRelease() function doesn't verify if there are sufficient tokens before attempting a transfer.
Resolved
#5 medium Issue
Inadequate Password Generation for Production Use
The generateRandomPassword function in utils.ts is used for generating passwords when creating encrypted keypairs, but it triggers a console warning about not being suitable for production use.
Resolved
#6 medium Issue
Lack of Signature Verification for Configuration Files
The authority-controls.ts file implements signed configurations, but the signature verification may not be performed consistently across all code paths.
low Issues | 1 findings
Resolved
#1 low Issue
Insufficient Input Validation for Public Keys
The processPurchase() function doesn't validate that the buyer address is a valid Solana public key before attempting to use it.
optimization Issues | 2 findings
Resolved
#1 optimization Issue
Hardcoded SOL Balance Thresholds
Several modules use hardcoded SOL thresholds (e.g., 0.1 SOL) for balance checks, making them inflexible to network conditions.
Pending
#2 optimization Issue
Inconsistent Error Handling
Error handling varies across modules, with some using the custom handleError() function and others using direct throws or console.error logging.
informational Issues | 1 findings
Resolved
#1 informational Issue
Unsound type guard check
'typeof' check is always false: 'keyName' always has type 'string'