EclipseFi Audit Case Study

BlockApex’s security audit team recently conducted a comprehensive review of EclipseFi, a prominent player in the Cosmos ecosystem. This in-depth audit covered critical components of EclipseFi’s platform, including vesting, staking, and locking functionalities. Utilizing a combination of filtered audits, extensive test suites, and black box testing approaches, BlockApex’s expert team identified and addressed several key issues, ensuring EclipseFi’s robustness and reliability in the DeFi space.

1. About EclipseFi

Background

Eclipse Fi is a revolutionary modular multi-chain launch protocol designed for the Cosmos ecosystem. It aims to transform the way token launches are conducted by offering a comprehensive toolkit that aligns long-term users with high-quality projects. By emphasizing custom solutions and innovative strategies, EclipseFi caters to a range of user preferences, reinforcing its role as a versatile and forward-thinking entity in the evolving DeFi landscape.

Vision and Mission

Eclipse Fi’s vision is to revolutionize token launches, empowering projects with integrity and quality to initiate and bootstrap liquidity. Its mission focuses on crafting the ultimate blockchain launchpad and protocol, fostering a community-driven space for refining launch mechanisms and providing essential education and support.

EclipseFi’s Role in DeFi

Overview

As a leading launch platform within the Cosmos ecosystem, Eclipse Fi offers a range of advanced functionalities, including account abstracted UX, anonymous KYC using zero-knowledge proofs, and a variety of launch options.

Importance in DeFi

Eclipse Fi addresses the challenges of traditional launchpads by emphasizing quality, sustainability, and long-term support for projects. This positions Eclipse Fi as a pivotal player in reshaping the DeFi landscape.

The Neutron Chain Connection

Role of Neutron Chain

Neutron is a blockchain network integrating Smart Contracts into the Cosmos-family blockchains. Its significance lies in using CosmWasm for smart contracts and Interchain Security from the Cosmos Hub, making it a key player in the Cosmos ecosystem.

EclipseFi and Neutron

Eclipse Fi’s choice of Neutron as its initial home base highlights its commitment to quality DeFi focus and cross-chain interoperability, crucial for effective token launches and liquidity solutions.

Launchpad’s Position and Innovation

Modular Solution

Eclipse Fi’s Launchpad stands out due to its modular approach, allowing projects to customize their launch processes with innovative mechanisms suitable for their unique needs.

Strategic Position in DeFi

The Launchpad’s role is pivotal in addressing existing gaps in DeFi launch platforms. It brings enhanced project support, innovative launch options, and a focus on long-term community engagement.

2. Challenges and Solutions in Token Launches

Existing Challenges

Traditional launchpads often suffer from poor project vetting, limited support, and a short-term focus, among other issues. Eclipse Fi aims to resolve these by emphasizing quality, modularity, and sustainability.

Eclipse Fi’s Approach

By offering a diverse range of launch mechanisms and a strong focus on community-driven and quality-centric approaches, Eclipse Fi is setting a new standard for token launches.

3. Security Challenges Associated with Launchpads in the DeFi Sector

The DeFi sector, while innovative, faces significant security challenges, especially concerning launchpads:

Smart Contract Vulnerabilities

Code Exploits: Smart contracts are prone to bugs and vulnerabilities, which can be exploited, leading to significant losses.
Auditing Limitations: Even with rigorous auditing, some smart contract vulnerabilities may remain undetected until exploited.

Platform Security Issues

Centralization Risks: Some launchpads have centralized elements, making them susceptible to hacks and single points of failure.
Lack of Regulation: The DeFi space operates with minimal regulation, increasing the risk of fraudulent activities and scams.

Phishing Attacks: Users are often targeted through phishing, tricking them into revealing sensitive information.
Lack of Awareness: Many users enter the DeFi space without adequate knowledge of security practices, making them vulnerable to various scams.

Measures to Mitigate Security Risks

Rigorous Smart Contract Audits: Conducting thorough smart contract audits and implementing bug bounty programs can help identify and fix vulnerabilities.
Enhanced User Education: Educating users about safe practices in DeFi is crucial for reducing the risk of scams and attacks.
Decentralization and Transparency: Adopting more decentralized structures and ensuring transparency in operations can enhance security and trust.

4. Eclipse’s Scope: Audit of Staking and Vesting Contracts

The audit of Eclipse Finance focused on two critical components: the cosmwasm vesting contract and the staking contract. These components play pivotal roles in the platform’s operation and security, managing token distribution and staking processes.

Vesting Contract

The vesting contract in Eclipse Finance is designed to manage the distribution schedules of tokens. Here’s how it works:

Token Distribution Schedules: Tokens distributed through the presale contract are vested in this contract. They are then released according to a predetermined schedule, ensuring a controlled and orderly distribution of tokens to participants.

Staking Contract

The staking contract is more complex, encompassing two main functionalities: staking and locking of funds.

Staking and Essence Earning: Users can stake their funds to earn ‘essence’ over time. However, if they decide to withdraw their staked amount, all accumulated essence is forfeited. The contract also restricts partial unstaking to maintain protocol integrity.

Locking Funds and Tiered Rewards: Users have the option to lock their staked amount for specific periods to receive additional rewards and essence. The locking period is divided into four tiers, each with its own distribution schedule and rewards. The longer the funds are locked, the higher the rewards.

Penalties for Early Withdrawal: If a user withdraws funds before the end of the locking period, they incur a penalty. This penalty fee is then distributed among the remaining stakers as a reward. Like with the staking process, partial unlocking of funds is not permitted under the contract.

5. Audit Focus

The audit concentrated on evaluating the design and implementation of these contracts, assessing their functionality and searching for potential vulnerabilities. This included:

Ensuring the accuracy and fairness of the token distribution and release schedules.
Verifying the staking mechanics and reward distributions, including the essence earning process.
Examining the locking tiers for funds and the associated rewards and penalties system.
Assessing the security measures in place to protect against unauthorized access and manipulation of the contracts.
By scrutinizing these aspects, the audit aimed to ensure the robustness and reliability of Eclipse Finance’s staking and vesting contracts, which are integral to the platform’s operation and users’ trust.

6. Outcomes: High-Level Overview and Score Allotted

The audit of EclipseFi’s vesting and staking contracts, conducted using BlockApex’s meticulous auditing methodology, resulted in a comprehensive analysis of the platform’s functionality and security. This process was divided into several key steps, ensuring a thorough and detailed evaluation.

Step 1: Documentation Review

The initial phase involved a thorough review of EclipseFi documentation. This was crucial to grasp the intended functionality and operational rules of the vesting and staking contracts. Understanding the foundational aspects set the stage for a more focused and effective audit.

Step 2: Invariant Identification

Identifying the key invariants, or the fundamental conditions and rules that must be consistently met, was the next crucial step. This phase established a clear framework for the subsequent testing, centering the audit around the most critical performance aspects of the contracts.

Step 3: Test Case Development and Execution

The final stage involved creating and executing specific test cases targeted at these invariants. The tests were designed not just to find potential flaws but also to confirm that the contracts performed as documented. This rigorous testing ensured a comprehensive assessment of both functionality and security.

7. Audit Findings and Security Score

After Remediation Measures

The comprehensive audit process undertaken by BlockApex revealed several issues in EclipseFi’s vesting and staking contracts. However, the EclipseFi team demonstrated a proactive and efficient response, addressing and fixing all identified issues. This commitment to security and functionality led to a significant improvement in the platform’s overall security posture.

Security Score: Well Secured

Post-remediation, the security score allocated to EclipseFi is “Well Secured.” This rating reflects the successful resolution of the previously identified concerns and underscores the effectiveness of the remediation efforts

Read the detailed Audit Report.

BlockApex’s thorough audit process underscores EclipseFi’s dedication to security and innovation. The identified issues were promptly addressed, reflecting EclipseFi’s commitment to continuous improvement and its position as a leader in the DeFi space

Future Implications

The improvements and enhancements resulting from this audit significantly bolster EclipseFi’s security framework, ensuring its platform remains a reliable and secure choice in the decentralized finance industry.