Thread by @RobotDefi

In a continued effort to help my buddy @0xLosingMoney whittle down his overflowing inbox, today I am going to do a quick layman's "security audit" for @SphereDeFi .

Okay...so here's some crazy analysis shit.

🕵️‍♂️/1

@0xLosingMoney @SphereDeFi As usual I add the disclaimer I am NOT a Solidity developer so I am only looking for glaringly obvious issues. Also, this is NOT a deep dive into the project, only a look into whether any security issues exist that investors should be aware of.

OK, let's get into $SPHERE

🕵️‍♂️/2

@0xLosingMoney @SphereDeFi First step (as always) is to check the @Token_Sniffer. There are a couple of issues with this one, however, that I'll address.

First, this appears to still be bringing up the V1 token, so it can't see the new liquidity.

🕵️‍♂️/3

@0xLosingMoney @SphereDeFi @Token_Sniffer $SPHERE actually has over 3mil in liquidity available on Tetuswap.

The other issues are fee modifiers and ownership renounce...

🕵️‍♂️/4

@0xLosingMoney @SphereDeFi @Token_Sniffer All #autostaking #rebase tokens have buy and sell fees. This is part of their model.

And most do not renounce ownership...I've been told this is because of the need to change fee structures.

Ok, let's move on then...

🕵️‍♂️/5

@0xLosingMoney @SphereDeFi @Token_Sniffer Next we look at the audit. It looks like Sphere got TWO audits actually.
Here are the major issues from @CertiK. It looks as if all three are issues with owner controls and centralization.

🕵️‍♂️/6

@0xLosingMoney @SphereDeFi @Token_Sniffer @CertiK And as you'll see Sphere's response was to incorporate a 4/8 Gnosis multisig. This multisig is on the entire contract, so it keeps both the funds safe as well as mitigates contract changes.

🕵️‍♂️/7

@0xLosingMoney @SphereDeFi @Token_Sniffer @CertiK On the other audit there was an issue with a fee modifier being left out of the total fee. Anyone that remembers the MaxAPY rug knows that is dangerous.

Thankfully, Sphere addressed it and changed it.

🕵️‍♂️/8

@0xLosingMoney @SphereDeFi @Token_Sniffer @CertiK So far the only issue I can see that someone may legitimately have is the amount of owner controls. But again, this is protected by a Gnosis contract.

🕵️‍♂️/9

@0xLosingMoney @SphereDeFi @Token_Sniffer @CertiK Next we'll look at holders. Unfortunately I couldn't find any pie chart that laid out allocations or tokenomics (tsk tsk), but in holders, the main contract is the Gnosis safe. The number two holder with 5% is also a contract. And no private wallet holds a large percentage

🕵️‍♂️/10

@0xLosingMoney @SphereDeFi @Token_Sniffer @CertiK Beyond that the team is KYC'd (I know I know, that doesn't mean much these days) but more than half of their Multisig signers are doxxed.

I also dug into the contract itself on polygonscan. Again, I'm not a developer but I looked for the usual stuff...

🕵️‍♂️/11

@0xLosingMoney @SphereDeFi @Token_Sniffer @CertiK There are a lot of modifiers, but none that give permissions to weird functions (besides, the contract owner isn't renounced anyway so they wouldn't have to do it this way).

There also weren't any weird functions or extra variables in constructors.

🕵️‍♂️/12

@0xLosingMoney @SphereDeFi @Token_Sniffer @CertiK Whois info didn't tell me much, and I couldn't find any job postings (but there are a ton of companies on Google with Sphere as a name so I could've just missed it).

BUT...

🕵️‍♂️/13

@0xLosingMoney @SphereDeFi @Token_Sniffer @CertiK My understanding is that @simsalacrypto founded Sphere, and he is a respected community member. Not only that but very trustworthy people in the space trust him.

This is a very good sign in my opinion.

🕵️‍♂️/14

@0xLosingMoney @SphereDeFi @Token_Sniffer @CertiK @simsalacrypto Overall I would have to say that @SphereDeFi looks like a legitimate project with no serious security issues.

Yes, the contract owner has a lot of control, but it is all mitigated by a robust multisig. Beyond that everything appears in order.

🕵️‍♂️/15

@0xLosingMoney @SphereDeFi @Token_Sniffer @CertiK @simsalacrypto Sphere also has an active Discord where communication is regular as well as a Youtube channel, so there are plenty of opportunities to interact with the team and get questions answered.

So I give Sphere a passing grade on this "security audit."

Cheers

🕵️‍♂️/finis