BNB Chain smart contract audits
BNB Chain is EVM compatible and home to many forks of established DeFi protocols, which is part of its risk: forked code is often modified without the original team's understanding. In the first quarter of 2023 BNB Chain had the highest number of security incidents of any chain. A HYDN audit reviews your contracts with that history in mind.
What we pay attention to on BNB Chain
- Forked code. We diff your contracts against the upstream protocol and review every change, every new parameter and every removed check.
- Thin liquidity. Any price read from a pool is checked for how cheaply it can be moved within a transaction. See oracle manipulation.
- Flash loans. We assume attackers can borrow large sums for one transaction and look for anything that becomes profitable as a result.
- Token behaviour. Fee-on-transfer, reflection and rebasing tokens are common, and many protocols do not handle them correctly.
- Admin control. Centralised owner powers in forks are often wider than in the original, and are a frequent source of losses.
Why this matters
Q1 2023 figures we reported at the time put BNB Chain at 139 security incidents in a single quarter, more than any other chain. Most were not novel. They were known patterns in code that had not been reviewed carefully after it was copied.
Frequently asked questions
We forked an audited protocol. Do we still need an audit?
Yes. The original audit covered the original code, deployment and integrations. Your changes, your parameters and the liquidity on your chain are new, and many exploited forks were broken by exactly those differences.
Why are price manipulation attacks common on BNB Chain?
Many pools have thin liquidity, which makes spot prices cheap to move, and flash loans are readily available. Protocols that read spot prices from those pools are easy targets.
Published Updated