Differential audit for ZOBTC

We audited the code changes between https://github.com/zofinance/zo-contract/commit/894b603b19328c5ad8207f93608de6daa5cc8a58 and ‣ , which also includes our recommended fixes. We found one low-severity issue and issued one advisory, both of which have been remediated by the team.

L-1: Incorrect Level Cap Validation in level_up Function

• Severity: Low
• Issue: The assertion uses card.level == CAP_LEVEL instead of card.level <= CAP_LEVEL
• ✅ Issue remediated

A-1: Code Duplication Between deposit and deposit_ptb Functions

• Severity: Advisory
• Issue: deposit/withdraw should call deposit_ptb/withdraw_ptb followed by pay_from_balance. This would avoid the code duplication.
• ✅ Issue remediated

Initial audit report

Summary

This is an audit report for the ZO protocol.

The inspected commit: https://github.com/zofinance/zo-contract/commit/894b603b19328c5ad8207f93608de6daa5cc8a58

Legal Disclaimer

Scope and Limitations

Issues