We are pleased to announce that Solidified has finished an extensive security audit of the Loopring Hebao wallet.
Designated “Hebao” (荷包) which means purse in ancient Chinese, Hebao is a standalone smart contract wallet with tight integration with the Loopring protocol aimed at easing the user onboarding to Ethereum and to Loopring's Layer 2.
Solidified has been engaged by Loopring to audit Hebao's codebase version 1, with an update audit of version 1.1.3. The interactive audit process has gone through various rounds and we are pleased to publish the final audit report.
Hebao is a modular smart contract wallet, and all modules were in scope, including modules for upgrades, daily limits, whitelists, recovery as well as the base implementation of the wallet.
The audit has been performed in two rounds by a team consisting of three lead auditors, using Solidified's unique audit process that encompasses layering the expertise of multiple specialists and ensures robust results, while minimizing the chance of missed details.
Each of the three auditors (on each of the two rounds) performed a full independent audit of the codebase. After the audits were done, the team debriefed by comparing the results of each individual audit, cross verifying all issues found. This creates a very healthy competition, and also makes it easy to assess the quality of individual work by comparing the results to the other's.
The audit team was in constant contact with the development team and issues encountered were discussed and any fixes supplied were re-audited. The final audit report contains a full history of issues discussed and fixed.
We have found the submitted code base of very good quality with excellent documentation. Test coverage is also very complete. Several issues were detected and we have found the team very receptive to suggestions for improvements. All issues encountered have been addressed by either fixing or mitigating them. In the case of some minor comments, the issues have been acknowledged as deliberate choices.
