Mezo Audit Findings Summary

This document summarizes all security findings from the Mezo audit competition.

Findings

1. BorrowerOperations Signature Balance Check Vulnerability

Severity: Medium

The BorrowerOperations._closeTrove function incorrectly checks the MUSD balance of the borrower instead of the caller when initiated via closeTroveWithSignature. This breaks the core intended functionality where a third party should provide funds to close another user's trove.

Impact: Breaks delegation functionality, preventing third-party trove closures
Root Cause: Balance check targets wrong address (_borrower instead of _caller)

2. MUSD Token Transfer Protection Bypass

Severity: Low

The MUSD token allows transfers to system contracts like StabilityPool despite documentation stating such transfers should be blocked. This can result in permanent loss of user funds.

Impact: Users can accidentally transfer tokens to system contracts, causing permanent fund loss
Root Cause: Implementation doesn't match documentation - missing protection for system contracts

3. CosmosSDK Math Dependency Vulnerability

Severity: Medium

The project uses vulnerable cosmossdk.io/math v1.3.0 which can cause node crashes due to interactions between sdk.Int and sdk.Dec types (ASA-2024-010).

Impact: Node crash leading to validator downtime (DoS)
Root Cause: Outdated dependency with known vulnerability

Summary Statistics

• Total Findings: 3
• Medium Severity: 2
• Low Severity: 1